| Summary: | Firewall Options: core 165 (testing) : 3 options not defaulted when doing a restore from 161 | ||
|---|---|---|---|
| Product: | IPFire | Reporter: | Rejjy_S <rejeancgrpq> |
| Component: | --- | Assignee: | Stefan Schantl <stefan.schantl> |
| Status: | CLOSED FIXED | QA Contact: | Peter Müller <peter.mueller> |
| Severity: | Balancing | ||
| Priority: | Will affect an average number of users | CC: | michael.tremer, peter.mueller, rejeancgrpq, stefan.schantl |
| Version: | 2 | ||
| Hardware: | unspecified | ||
| OS: | Unspecified | ||
|
Description
Rejjy_S
2022-03-05 05:11:03 UTC
Peter, I added you to the email list because the 'iptables v1.8.7 (legacy): Set CC_XD doesn't exist.' is related to turning ON the option of. ‘Drop packets from and to hostile networks (listed at Spamhaus DROP, etc.)’ a new feature which I believe you wrote about not long ago. Manually enabling the other two non-defaulted options alone ‘Log dropped packets classified as INVALID by connection tracking’ ‘Log dropped spoofed packets and marsians’ does not produce the said messages. Hello Rejjy, I've sent a patch to the mailing list to solve the issue with the three newly introduced options and no default values for them. https://patchwork.ipfire.org/project/ipfire/patch/20220305181339.4389-1-stefan.schantl@ipfire.org/ Let's see why this CC_XD messages appears on boot. Best regards, -Stefan The CC_XD messages came from the highly experimental c165 image. So nevermind, they are not part of c164, are part of the current development process will be fixed until c165 will be released. - Stefan Thanks for update Stefan. I still see newest 164 testing as being Feb26. Has the IPS restore fix been applied to it and a new 164 testing available for check out ? Last I heard I believe MT was possibly going to keep the IPS portion as it was on 163 in order to make 164 stable available soon, thus the move to next. Hi Stefan I'm just finishing testing the latest ver 164 master/b69659af full install from the .iso All three have default values set on startup. However, the ‘Drop packets from and to hostile networks (listed at Spamhaus DROP, etc.)’ which your patch ( re comment 2) required it to be set to OFF, is set to TRUE. Also, when doing a restore from my 161 backup puts these back into a blank no default state. Appears the patch never made it to the 164 164 master/b69659af Hello Rejjy, I can confirm that the patch does not make it into C164, but it is already merged into C165 which should be okay - only installations with an older backup are affected, so would not see this as a blocker for C164. The default value for new installations for dropping hostile networks should be set to ON, on existing or restored machines that should be OFF which is correct here. Thanks for testing and your feedback. Best regards, -Stefan (In reply to Stefan Schantl from comment #6) > Hello Rejjy, > > I can confirm that the patch does not make it into C164, but it is already > merged into C165 which should be okay - only installations with an older > backup are affected, so would not see this as a blocker for C164. The patch is included in c164. (In reply to Rejjy_S from comment #1) > Peter, I added you to the email list because the > 'iptables v1.8.7 (legacy): Set CC_XD doesn't exist.' And this message should be gone in latest builds of c165. I'm going to close this bug, because the fix has been shipped with Core 164. Don't think this is really considered fixed. ‘Drop packets from and to hostile networks (listed at Spamhaus DROP, etc.)’ which your patch ( re comment 2) required it to be set to OFF, is set to TRUE. In 164 I found issues with IPS updating forever with it set to the default ON in core 164. Setting this to OFF resolved the issue in my case. See community [Core 164] IPS Ruleset update in progress with no end. upgrade from 163 to 164 |