lkml.org 
[lkml]   [1998]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: ipfwadm problems with 2.1.120
Date
	Sigh...  Another one that should be in an FAQ...  But then we end
up pointing people at FAQ's all the time...

Matthew J. Probst enscribed thusly:
> Sorry if this has already been clarified, but I cant seem to get ipfwadm
> to work with 2.1.120:

> [root@opus init.d]# /sbin/ipfwadm -F -p deny
> ipfwadm: setsockopt failed: Invalid argument
> [root@opus init.d]# /sbin/ipfwadm -F -a m -S 172.16.1.0/24 -D 0.0.0.0/0 -W
> eth0
> ipfwadm: setsockopt failed: No such file or directory
> [root@opus init.d]#


> I can't compile ipfwadm using the 2.1.120 source tree either.

No doubt! Latest 2.1.x kernels are now using ipchains instead
of ipfwadm. They are suppose to be thread safe (and subsequently
SMP safe) which the ipfwadm code was not. They also seem quite versatile
and support some nice new features like port forwarding and such.

Basically, ipfwadm is history. It's successor is ipchains, so
you might as well gear up and change over. There's a neat script with
ipchains that replaces ipfwadm and does translations on the fly for
the ipfwadm parameters. The big one that is NOT supported is the -V {addr}
option which gets translated to the equivalent of the -W {iface} option
which is supported (as translated). I used a modified version of that
script to generate equivalent commands for ipchains from ipfwadm and
set up new scripts. So far, things look pretty good and I like it.

For the rest of the crowd reading this...

I'm interesting in one thing, though. What about ipchains and
IPv6? I'm interested and almost ready to hook two significant networks
to the 6Bone but can't yet. I don't want to compromise our firewall
by erecting an IPv6-IPv4 tunnel through the firewall and short circuiting
our protection. What are the plans on migrating the ipchains code over
to the IPv6 tree? Then there's also IPsec (ESP and AH on IPv6) but that's
a totally different story from this one...


> ______________________________________________________________________________
> Matthew J. Probst | Never underestimate the bandwidth of a station
> Sys. Programmer, BYU CS Dept |wagon full of tapes hurtling down the highway.
> mprobst@cs.byu.edu | -Andrew Tanenbaum

Mike
--
Michael H. Warfield | (770) 985-6132 | mhw@WittsEnd.com
(The Mad Wizard) | (770) 925-8248 | http://www.wittsend.com/mhw/
NIC whois: MHW9 | An optimist believes we live in the best of all
PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/faq.html

\
 
 \ /
  Last update: 2005-03-22 13:44    [W:0.057 / U:0.056 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site