[Berlin-wireless] Kleine Fragen zwischendurch - war:Komische Fehlermeldung

[Rolf Pfeiffer]

Am Freitag, den 10.09.2010, 03:32 +0200 schrieb Jo-Philipp Wich:
> Sollte mindest 10.03.1-rc1 sein, die firewall setzt ein paar features in
> base-files vorraus die früher nicht da waren.

OK - das probier ich lieber am Schreibtisch aus. thx.

Noch mehr Fragen:

wenn der Freifunk-Assistent durchgelaufen ist, steht in der
firewall-config ein forwarding freifunk->freifunk. Ist das nötig? Ich
hab das Konzept bis jetzt so verstanden, daß Verkehr innerhalb einer
zone generell durchgelassen wird.

Mag jemand in die angehängten Dateien reinschauen? So wie ich sie lese,
laufen alle Pakete in der POSTROUTING-Chain durch die (leere)
postrouting_rule, dann durch zone_wan_nat, wo sie direkt im target
MASQUERADE landen.

Die natfixes kommen demnach garnicht zum Zuge - aber funktionieren tut
es trotzdem - wieso?

Rolf
-------------- nächster Teil --------------

config 'defaults'
	option 'syn_flood' '1'
	option 'input' 'ACCEPT'
	option 'output' 'ACCEPT'
	option 'drop_invalid' '0'
	option 'forward' 'ACCEPT'

config 'include'
	option 'path' '/etc/firewall.freifunk'

config 'zone'
	option 'name' 'wan'
	option 'input' 'ACCEPT'
	option 'output' 'ACCEPT'
	option 'masq' '1'
	option 'mtu_fix' '1'
	option 'local_restrict' '1'
	option 'forward' 'ACCEPT'

config 'zone'
	option 'name' 'freifunk'
	option 'input' 'ACCEPT'
	option 'forward' 'ACCEPT'
	option 'output' 'ACCEPT'
	option 'masq' '1'
	option 'network' 'lan wifi0 wifi1 wifi2'

config 'include'
	option 'path' '/etc/firewall.user'

config 'advanced'
	option 'tcp_westwood' '1'
	option 'tcp_ecn' '0'
	option 'ip_conntrack_max' '8192'

-------------- nächster Teil --------------
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
zone_freifunk_prerouting  all  --  anywhere             anywhere            
zone_freifunk_prerouting  all  --  anywhere             anywhere            
zone_freifunk_prerouting  all  --  anywhere             anywhere            
zone_wan_prerouting  all  --  anywhere             anywhere            
zone_freifunk_prerouting  all  --  anywhere             anywhere            
prerouting_rule  all  --  anywhere             anywhere            

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
postrouting_rule  all  --  anywhere             anywhere            
zone_wan_nat  all  --  anywhere             anywhere            
zone_freifunk_nat  all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain natfix_ath0 (1 references)
target     prot opt source               destination         
ACCEPT     all  --  104.0.0.0/8          104.0.0.0/8         

Chain natfix_ath1 (1 references)
target     prot opt source               destination         
ACCEPT     all  --  104.0.0.0/8          104.0.0.0/8         

Chain natfix_ath2 (1 references)
target     prot opt source               destination         
ACCEPT     all  --  104.0.0.0/8          104.0.0.0/8         

Chain natfix_eth0 (1 references)
target     prot opt source               destination         
ACCEPT     all  --  192.168.1.0/24       192.168.1.0/24      

Chain natfix_eth1 (1 references)
target     prot opt source               destination         
ACCEPT     all  --  104.10.2.16/29       104.10.2.16/29      

Chain postrouting_rule (1 references)
target     prot opt source               destination         

Chain prerouting_freifunk (1 references)
target     prot opt source               destination         

Chain prerouting_rule (1 references)
target     prot opt source               destination         

Chain prerouting_wan (1 references)
target     prot opt source               destination         

Chain zone_freifunk_nat (1 references)
target     prot opt source               destination         
MASQUERADE  all  --  anywhere             anywhere            
MASQUERADE  all  --  anywhere             anywhere            
MASQUERADE  all  --  anywhere             anywhere            
MASQUERADE  all  --  anywhere             anywhere            
natfix_ath2  all  --  anywhere             anywhere            
natfix_ath1  all  --  anywhere             anywhere            
natfix_ath0  all  --  anywhere             anywhere            
natfix_eth1  all  --  anywhere             anywhere            

Chain zone_freifunk_prerouting (4 references)
target     prot opt source               destination         
prerouting_freifunk  all  --  anywhere             anywhere            

Chain zone_wan_nat (1 references)
target     prot opt source               destination         
MASQUERADE  all  --  anywhere             anywhere            
natfix_eth0  all  --  anywhere             anywhere            

Chain zone_wan_prerouting (1 references)
target     prot opt source               destination         
prerouting_wan  all  --  anywhere             anywhere