X-Original-To: alpine-devel@lists.alpinelinux.org
Delivered-To: alpine-devel@mail.alpinelinux.org
Received: from jeremythomerson.com (mail.jeremythomerson.com [74.117.189.150])
	by mail.alpinelinux.org (Postfix) with ESMTP id B6BD9DC35DC
	for <alpine-devel@lists.alpinelinux.org>; Wed, 26 Sep 2012 14:33:05 +0000 (UTC)
Received: from mail-pb0-f54.google.com (mail-pb0-f54.google.com [209.85.160.54])
	by jeremythomerson.com (Postfix) with ESMTP id DC4E11CAA8
	for <alpine-devel@lists.alpinelinux.org>; Wed, 26 Sep 2012 09:36:21 -0500 (CDT)
Received: by pbbrp8 with SMTP id rp8so2365807pbb.13
        for <alpine-devel@lists.alpinelinux.org>; Wed, 26 Sep 2012 07:33:04 -0700 (PDT)
Received: by 10.68.229.228 with SMTP id st4mr2937650pbc.106.1348669984081;
 Wed, 26 Sep 2012 07:33:04 -0700 (PDT)
X-Mailinglist: alpine-devel
Precedence: list
List-Id: Alpine Development <alpine-devel.lists.alpinelinux.org>
List-Unsubscribe: 
	<mailto:alpine-devel+unsubscribe@lists.alpinelinux.org?subject=unsubscribe>
List-Post: <mailto:alpine-devel@lists.alpinelinux.org>
List-Help: <mailto:alpine-devel+help@lists.alpinelinux.org?subject=help>
List-Subscribe: 
	<mailto:alpine-devel+subscribe@lists.alpinelinux.org?subject=subscribe>
MIME-Version: 1.0
Reply-To: jeremy@thomersonfamily.com
Received: by 10.66.14.229 with HTTP; Wed, 26 Sep 2012 07:32:43 -0700 (PDT)
In-Reply-To: <alpine.LFD.2.02.1209261704360.5933@kunkku.net>
References: <CADVmKVB+6-FzXoX-t8jxgOjpCRN4Dv=xeX8vYvqjw1jsi8kRRg@mail.gmail.com>
 <20120926090749.4523d331@ncopa-desktop.nor.wtbts.net> <alpine.LFD.2.02.1209261704360.5933@kunkku.net>
From: Jeremy Thomerson <jeremy@thomersonfamily.com>
Date: Wed, 26 Sep 2012 09:32:43 -0500
Message-ID: <CADVmKVAG6S_qHJKPw4GLie7HeJDmSH-_kw7qNxKiKEcX9+LK8A@mail.gmail.com>
Subject: Re: [alpine-devel] awall - forward to/from same port
To: Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi>
Cc: Natanael Copa <ncopa@alpinelinux.org>, 
	Alpine-devel <alpine-devel@lists.alpinelinux.org>
Content-Type: multipart/alternative; boundary=047d7b33c85c5207f404ca9bb3f4

--047d7b33c85c5207f404ca9bb3f4
Content-Type: text/plain; charset=ISO-8859-1

On Wed, Sep 26, 2012 at 9:10 AM, Kaarle Ritvanen <
kaarle.ritvanen@datakunkku.fi> wrote:

> On Wed, 26 Sep 2012, Natanael Copa wrote:
>
>  On Tue, 25 Sep 2012 12:34:53 -0500
>> Jeremy Thomerson <jeremy@thomersonfamily.com> wrote:
>>
>>> The problem is that awall didn't create a rule in the forward chain
>>> for -i gre1 -o gre1.
>>>
>>
>> Not that it means that awall should do the same, but in shorewall you
>> add an option called "routeback" to the interface definition.
>>
>
> Well, we could add similar attribute to zone definitions or just make
> awall always generate such rules. The downside of the latter option is that
> those rules are likely unnecessary in most cases, causing a slight penalty
> in performance. What do you think?
>

Perhaps we could add the attribute to the filter definition instead.  i.e.:

                {
                        "in": "T",
                        "out": "T",
                        "action": "accept",
                        "routeback": "true"
                }

OR:

                {
                        "in": "T",
                        "out": "T",
                        "action": "acceptandrouteback"
                }

--047d7b33c85c5207f404ca9bb3f4
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<br><br><div class=3D"gmail_quote">On Wed, Sep 26, 2012 at 9:10 AM, Kaarle =
Ritvanen <span dir=3D"ltr">&lt;<a href=3D"mailto:kaarle.ritvanen@datakunkku=
.fi" target=3D"_blank">kaarle.ritvanen@datakunkku.fi</a>&gt;</span> wrote:<=
br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left=
:1px #ccc solid;padding-left:1ex">


<div>On Wed, 26 Sep 2012, Natanael Copa wrote:<br>
<br>
</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-l=
eft:1px #ccc solid;padding-left:1ex"><div>
On Tue, 25 Sep 2012 12:34:53 -0500<br>
Jeremy Thomerson &lt;<a href=3D"mailto:jeremy@thomersonfamily.com" target=
=3D"_blank">jeremy@thomersonfamily.com</a>&gt; wrote:<br>
</div><div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bor=
der-left:1px #ccc solid;padding-left:1ex">
The problem is that awall didn&#39;t create a rule in the forward chain<br>
for -i gre1 -o gre1.<br>
</blockquote>
<br>
Not that it means that awall should do the same, but in shorewall you<br>
add an option called &quot;routeback&quot; to the interface definition.<br>
</div></blockquote>
<br>
Well, we could add similar attribute to zone definitions or just make awall=
 always generate such rules. The downside of the latter option is that thos=
e rules are likely unnecessary in most cases, causing a slight penalty in p=
erformance. What do you think?<br>


</blockquote><div><br></div><div></div></div><div>Perhaps we could add the =
attribute to the filter definition instead. =A0i.e.:</div><div><br></div><d=
iv><div>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 {</div><div>=A0 =A0 =A0 =A0 =A0 =A0=
 =A0 =A0 =A0 =A0 =A0 =A0 &quot;in&quot;: &quot;T&quot;, =A0</div>


<div>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 &quot;out&quot;: &quot=
;T&quot;, =A0 =A0 =A0</div><div><div>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =
=A0 =A0 =A0 &quot;action&quot;: &quot;accept&quot;,</div></div><div><div>=
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 &quot;routeback&quot;: &quo=
t;true&quot;</div>


</div><div>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 }</div></div><div><br></div><div=
>OR:</div><div><br></div><div><div>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 {</div><=
div>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 &quot;in&quot;: &quot;T=
&quot;, =A0</div><div>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 &quot=
;out&quot;: &quot;T&quot;, =A0 =A0 =A0</div>

<div>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 &quot;action&quot;: &q=
uot;acceptandrouteback&quot;</div><div>=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 }</d=
iv></div>

--047d7b33c85c5207f404ca9bb3f4--


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---