X-Original-To: alpine-devel@lists.alpinelinux.org
Delivered-To: alpine-devel@mail.alpinelinux.org
Received: from jeremythomerson.com (mail.jeremythomerson.com [74.117.189.150])
	by mail.alpinelinux.org (Postfix) with ESMTP id ABC0EDC37AD
	for <alpine-devel@lists.alpinelinux.org>; Wed,  3 Oct 2012 15:39:44 +0000 (UTC)
Received: from mail-pb0-f54.google.com (mail-pb0-f54.google.com [209.85.160.54])
	by jeremythomerson.com (Postfix) with ESMTP id 321441CAFA
	for <alpine-devel@lists.alpinelinux.org>; Wed,  3 Oct 2012 10:46:07 -0500 (CDT)
Received: by pbbrp8 with SMTP id rp8so11542043pbb.13
        for <alpine-devel@lists.alpinelinux.org>; Wed, 03 Oct 2012 08:39:42 -0700 (PDT)
Received: by 10.68.242.231 with SMTP id wt7mr13779911pbc.99.1349278782616;
 Wed, 03 Oct 2012 08:39:42 -0700 (PDT)
X-Mailinglist: alpine-devel
Precedence: list
List-Id: Alpine Development <alpine-devel.lists.alpinelinux.org>
List-Unsubscribe: 
	<mailto:alpine-devel+unsubscribe@lists.alpinelinux.org?subject=unsubscribe>
List-Post: <mailto:alpine-devel@lists.alpinelinux.org>
List-Help: <mailto:alpine-devel+help@lists.alpinelinux.org?subject=help>
List-Subscribe: 
	<mailto:alpine-devel+subscribe@lists.alpinelinux.org?subject=subscribe>
MIME-Version: 1.0
Reply-To: jeremy@thomersonfamily.com
Received: by 10.66.221.233 with HTTP; Wed, 3 Oct 2012 08:39:22 -0700 (PDT)
In-Reply-To: <alpine.LFD.2.02.1210031044220.23327@kunkku.net>
References: <CADVmKVB+6-FzXoX-t8jxgOjpCRN4Dv=xeX8vYvqjw1jsi8kRRg@mail.gmail.com>
 <20120926090749.4523d331@ncopa-desktop.nor.wtbts.net> <alpine.LFD.2.02.1209261704360.5933@kunkku.net>
 <20120927101314.65e3bcf1@ncopa-desktop.nor.wtbts.net> <alpine.LFD.2.02.1210031044220.23327@kunkku.net>
From: Jeremy Thomerson <jeremy@thomersonfamily.com>
Date: Wed, 3 Oct 2012 10:39:22 -0500
Message-ID: <CADVmKVAB7Y565+YworL_mpiwwHNUb3wcaME1eDWLiPNe01JFmA@mail.gmail.com>
Subject: Re: [alpine-devel] awall - forward to/from same port
To: Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi>
Cc: Natanael Copa <ncopa@alpinelinux.org>, 
	Alpine-devel <alpine-devel@lists.alpinelinux.org>
Content-Type: multipart/alternative; boundary=047d7b339c838a743d04cb297236

--047d7b339c838a743d04cb297236
Content-Type: text/plain; charset=ISO-8859-1

On Wed, Oct 3, 2012 at 2:52 AM, Kaarle Ritvanen <
kaarle.ritvanen@datakunkku.fi> wrote:

> On Thu, 27 Sep 2012, Natanael Copa wrote:
>
>  On Wed, 26 Sep 2012 17:10:13 +0300 (EEST)
>> Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi**> wrote:
>>
>>  Well, we could add similar attribute to zone definitions or just make
>>> awall always generate such rules. The downside of the latter option
>>> is that those rules are likely unnecessary in most cases, causing a
>>> slight penalty in performance. What do you think?
>>>
>>
>> Always generate such rules? No, I'd prefer it be optional and default
>> off.
>>
>> Re adding the feature to filter section vs zone definition, I suppose
>> the benefit with adding it to zone definition is that it would be
>> slightly easier to make scripts that ports shorewall config to awall.
>>
>
> I added an optional 'route-back' attribute to zone definitions. Note that
> this does not as such allow any traffic, but just allows the filter rule to
> produce iptables rules with identical ingress and egress interfaces.
>
> This feature is available in version 0.2.11.
>

Thanks Kaarle!  That worked great.  I do have a question.  Do you have a
plan to update http://wiki.alpinelinux.org/wiki/How-To_Alpine_Wall to show
the new logging stuff?  My "logdrop" and "logreject" are now deprecated,
and I found on http://wiki.alpinelinux.org/wiki/Alpine_Wall_User%27s_Guidethat
there is a different way of configuring this now.  But that makes the
first link above out of date.  I'm wondering if we should consolidate that
first page into the second so it's more likely to stay up-to-date.

Thanks again,
Jeremy Thomerson

--047d7b339c838a743d04cb297236
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<br><div class=3D"gmail_quote">On Wed, Oct 3, 2012 at 2:52 AM, Kaarle Ritva=
nen <span dir=3D"ltr">&lt;<a href=3D"mailto:kaarle.ritvanen@datakunkku.fi" =
target=3D"_blank">kaarle.ritvanen@datakunkku.fi</a>&gt;</span> wrote:<br><b=
lockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px =
#ccc solid;padding-left:1ex">

<div class=3D"im">On Thu, 27 Sep 2012, Natanael Copa wrote:<br>
<br>
</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-l=
eft:1px #ccc solid;padding-left:1ex"><div class=3D"im">
On Wed, 26 Sep 2012 17:10:13 +0300 (EEST)<br>
Kaarle Ritvanen &lt;<a href=3D"mailto:kaarle.ritvanen@datakunkku.fi" target=
=3D"_blank">kaarle.ritvanen@datakunkku.fi</a><u></u>&gt; wrote:<br>
<br>
</div><div class=3D"im"><blockquote class=3D"gmail_quote" style=3D"margin:0=
 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Well, we could add similar attribute to zone definitions or just make<br>
awall always generate such rules. The downside of the latter option<br>
is that those rules are likely unnecessary in most cases, causing a<br>
slight penalty in performance. What do you think?<br>
</blockquote>
<br>
Always generate such rules? No, I&#39;d prefer it be optional and default<b=
r>
off.<br>
<br>
Re adding the feature to filter section vs zone definition, I suppose<br>
the benefit with adding it to zone definition is that it would be<br>
slightly easier to make scripts that ports shorewall config to awall.<br>
</div></blockquote>
<br>
I added an optional &#39;route-back&#39; attribute to zone definitions. Not=
e that this does not as such allow any traffic, but just allows the filter =
rule to produce iptables rules with identical ingress and egress interfaces=
.<br>


<br>
This feature is available in version 0.2.11.<br></blockquote><div><br>Thank=
s Kaarle!=A0 That worked great.=A0 I do have a question.=A0 Do you have a p=
lan to update <a href=3D"http://wiki.alpinelinux.org/wiki/How-To_Alpine_Wal=
l">http://wiki.alpinelinux.org/wiki/How-To_Alpine_Wall</a> to show the new =
logging stuff?=A0 My &quot;logdrop&quot; and &quot;logreject&quot; are now =
deprecated, and I found on <a href=3D"http://wiki.alpinelinux.org/wiki/Alpi=
ne_Wall_User%27s_Guide">http://wiki.alpinelinux.org/wiki/Alpine_Wall_User%2=
7s_Guide</a> that there is a different way of configuring this now.=A0 But =
that makes the first link above out of date.=A0 I&#39;m wondering if we sho=
uld consolidate that first page into the second so it&#39;s more likely to =
stay up-to-date.<br>

<br>Thanks again,<br>Jeremy Thomerson<br></div></div><br>

--047d7b339c838a743d04cb297236--


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---