firewalld-devel

firewalld-devel@lists.fedorahosted.org

94 discussions

[PATCH] feat(bash): completion of policy-related commands
by Olav Reinert 03 Jun '22

03 Jun '22

Also contains: - Completion for --set-target zones. - Completion for --set-log-denied value. - Completion for --add/remove/query-protocol value. - Improved separation of permanent and non-permanent options. Fixes: #827 --- shell-completion/bash/firewall-cmd | 129 +++++++++++++++++++++-------- 1 file changed, 96 insertions(+), 33 deletions(-) diff --git a/shell-completion/bash/firewall-cmd b/shell-completion/bash/firewall-cmd index 494f8fa9..7ca2d346 100644 --- a/shell-completion/bash/firewall-cmd +++ b/shell-completion/bash/firewall-cmd @@ -32,10 +32,10 @@ OPTIONS_LOCKDOWN="--add-lockdown-whitelist-command= --remove-lockdown-whitelist- --query-lockdown-whitelist-user= --list-lockdown-whitelist-users" # can be used as standalone or with --permanent -OPTIONS_CONFIG="--get-zones --get-services --get-icmptypes --get-helpers \ - ${OPTIONS_LOCKDOWN} --list-all-zones \ - --info-zone= --info-service= --info-icmptype= \ - --info-ipset= --info-helper=" +OPTIONS_CONFIG="--get-zones --get-policies --get-services --get-icmptypes --get-helpers \ + ${OPTIONS_LOCKDOWN} --list-all-zones --list-all-policies \ + --info-zone= --info-policy= --info-service= --info-icmptype= \ + --info-ipset= --info-helper=" OPTIONS_ZONE_INTERFACES_SOURCES="\ --add-interface= --remove-interface= --query-interface= \ @@ -43,24 +43,37 @@ OPTIONS_ZONE_INTERFACES_SOURCES="\ --add-source= --remove-source= --query-source= \ --change-source= --list-sources" -OPTIONS_ZONE_ACTION_ACTION="--add-service= --remove-service= --query-service= \ +OPTIONS_ZONE_POLICY_ACTION="--list-all \ + --list-services \ + --add-service= --remove-service= --query-service= \ + --list-ports \ --add-port= --remove-port= --query-port= \ - --add-source-port= --remove-source-port= --query-source-port= \ + --list-protocols \ --add-protocol= --remove-protocol= --query-protocol= \ + --list-source-ports \ + --add-source-port= --remove-source-port= --query-source-port= \ + --list-icmp-blocks \ --add-icmp-block= --remove-icmp-block= --query-icmp-block= \ - --add-forward-port= --remove-forward-port= --query-forward-port=" + --list-forward-ports \ + --add-forward-port= --remove-forward-port= --query-forward-port= \ + --add-masquerade --remove-masquerade --query-masquerade \ + --list-rich-rules \ + --add-rich-rule= --remove-rich-rule= --query-rich-rule=" -OPTIONS_ZONE_ADAPT_QUERY="--add-rich-rule= --remove-rich-rule= --query-rich-rule= \ - --add-icmp-block-inversion --remove-icmp-block-inversion \ +OPTIONS_ZONE_ADAPT_QUERY="--add-icmp-block-inversion --remove-icmp-block-inversion \ --query-icmp-block-inversion \ - --add-forward --remove-forward --query-forward \ - --add-masquerade --remove-masquerade --query-masquerade \ - --list-services --list-ports --list-protocols \ - --list-source-ports --list-icmp-blocks \ - --list-forward-ports --list-rich-rules --list-all" + --add-forward --remove-forward --query-forward" + +OPTIONS_POLICY_ADAPT_QUERY="--list-ingress-zones \ + --add-ingress-zone= --remove-ingress-zone= --query-ingress-zone= \ + --list-egress-zones \ + --add-egress-zone= --remove-egress-zone= --query-egress-zone=" + +OPTIONS_ZONE_POLICY_PERMANENT="--get-description --set-description= \ + --get-short --set-short= \ + --get-target --set-target=" -OPTIONS_ZONE_PERMANENT_ONLY="--get-description --get-short \ - --set-description= --set-short=" +OPTIONS_POLICY_PERMANENT="--get-priority --set-priority=" OPTIONS_IPSET_ACTION_ACTION="--add-entry= --remove-entry= --query-entry= --add-entries-from-file= --remove-entries-from-file" @@ -68,8 +81,12 @@ OPTIONS_IPSET_ADAPT_QUERY="--list-entries" # can be used with/without preceding --zone=<zone> OPTIONS_ZONE="${OPTIONS_ZONE_INTERFACES_SOURCES} \ - ${OPTIONS_ZONE_ACTION_ACTION} ${OPTIONS_ZONE_ADAPT_QUERY} - ${OPTIONS_ZONE_PERMANENT_ONLY}" + ${OPTIONS_ZONE_POLICY_ACTION} \ + ${OPTIONS_ZONE_ADAPT_QUERY}" + +# can be used with preceeding --policy=<policy> +OPTIONS_POLICY="${OPTIONS_ZONE_POLICY_ACTION} \ + ${OPTIONS_POLICY_ADAPT_QUERY}" OPTIONS_IPSET="${OPTIONS_IPSETACTION_ACTION} ${OPTIONS_IPSET_ADAPT_QUERY}" @@ -77,10 +94,11 @@ OPTIONS_PERMANENT_ONLY="--new-icmptype= --new-icmptype-from-file= --delete-icmpt --new-service= --new-service-from-file= --delete-service= \ --new-zone= --new-zone-from-file= --delete-zone= \ --load-zone-defaults= \ + --new-policy= --new-policy-from-file= --delete-policy= \ + --load-policy-defaults= \ --new-ipset= --new-helper-from-file= --delete-ipset= \ --new-helper= --new-helper-from-file= --delete-helper= \ - --get-target --set-target= \ - --path-zone= --path-service= --path-icmptype= \ + --path-zone= --path-policy= --path-service= --path-icmptype= \ --path-ipset= --path-helper=" OPTIONS_NEW_IPSET="--type= --option=" @@ -90,14 +108,17 @@ OPTIONS_NEW_HELPER="--module= --family=" OPTIONS_HELPER="" # can be used after --permanent -OPTIONS_PERMANENT="${OPTIONS_CONFIG} --zone= ${OPTIONS_ZONE} \ - ${OPTIONS_PERMANENT_ONLY}" +OPTIONS_PERMANENT="${OPTIONS_CONFIG} \ + ${OPTIONS_PERMANENT_ONLY} \ + --zone= ${OPTIONS_ZONE} \ + --policy= ${OPTIONS_POLICY_PERMANENT} \ + ${OPTIONS_ZONE_POLICY_PERMANENT}" OPTIONS_DIRECT="--passthrough \ --add-chain --remove-chain --query-chain --get-chains --get-all-chains \ - --add-rule --remove-rule --remove-rules --query-rule --get-rules --get-all-rules \ - --add-passthrough --remove-passthrough \ - --query-passthrough --get-passthroughs --get-all-passthroughs" + --add-rule --remove-rule --remove-rules --query-rule --get-rules --get-all-rules \ + --add-passthrough --remove-passthrough \ + --query-passthrough --get-passthroughs --get-all-passthroughs" # these all can be used as a "first" option OPTIONS_GENERAL="--help --version \ @@ -110,6 +131,7 @@ OPTIONS_GENERAL="--help --version \ --get-zone-of-interface= --get-zone-of-interface= \ ${OPTIONS_CONFIG} \ --zone= ${OPTIONS_ZONE} \ + --policy= \ --permanent --direct" _firewall_cmd() @@ -119,8 +141,8 @@ _firewall_cmd() case $prev in --*-entries-from-file|--new-*-from-file) - _filedir - return + _filedir + return ;; --new-ipset*) if [[ "$cur" == -* ]]; then @@ -141,8 +163,34 @@ _firewall_cmd() COMPREPLY=( $( compgen -W '`firewall-cmd --get-zones`' -- "$cur" ) ) fi ;; + --add-ingress-zone|--remove-ingress-zone|--query-ingress-zone|\ + --add-egress-zone|--remove-egress-zone|--query-egress-zone) + if [[ ${words[@]} == *--permanent* ]]; then + COMPREPLY=( $( compgen -W '`firewall-cmd --permanent --get-zones` HOST ANY' -- "$cur" ) ) + else + COMPREPLY=( $( compgen -W '`firewall-cmd --get-zones` HOST ANY' -- "$cur" ) ) + fi + ;; + --policy|--info-policy|--path-policy|--load-policy-defaults|--delete-policy) + if [[ ${words[@]} == *--permanent* ]]; then + COMPREPLY=( $( compgen -W '`firewall-cmd --permanent --get-policies`' -- "$cur" ) ) + else + COMPREPLY=( $( compgen -W '`firewall-cmd --get-policies`' -- "$cur" ) ) + fi + ;; --zone=*) - COMPREPLY=( $( compgen -W "${OPTIONS_ZONE}" -- "$cur" ) ) + if [[ ${words[@]} == *--permanent* ]]; then + COMPREPLY=( $( compgen -W "${OPTIONS_ZONE} ${OPTIONS_ZONE_POLICY_PERMANENT}" -- "$cur" ) ) + else + COMPREPLY=( $( compgen -W "${OPTIONS_ZONE}" -- "$cur" ) ) + fi + ;; + --policy=*) + if [[ ${words[@]} == *--permanent* ]]; then + COMPREPLY=( $( compgen -W "${OPTIONS_POLICY} ${OPTIONS_POLICY_PERMANENT} ${OPTIONS_ZONE_POLICY_PERMANENT}" -- "$cur" ) ) + else + COMPREPLY=( $( compgen -W "${OPTIONS_POLICY}" -- "$cur" ) ) + fi ;; --ipset=*) COMPREPLY=( $( compgen -W "${OPTIONS_IPSET}" -- "$cur" ) ) @@ -186,6 +234,8 @@ _firewall_cmd() --list-forward-ports|--add-forward-port=*|--remove-forward-port=*|--query-forward-port=*|\ --list-interfaces|--add-interface=*|--remove-interface=*|--query-interface=*|\ --list-sources|--add-source=*|--remove-source=*|--query-source=*|\ + --add-ingress-zone=*|--remove-ingress-zone=*|\ + --add-egress-zone=*|--remove-egress-zone=*|\ --add-forward|--remove-forward|--query-forward|\ --add-masquerade|--remove-masquerade|--query-masquerade|--list-all|\ --get-description|--get-short|--set-description=*|--set-short=*) @@ -222,6 +272,19 @@ _firewall_cmd() --passthrough|--*-chain|--get-chains|--*-rule|--get-rules|--remove-rules) COMPREPLY=( $( compgen -W 'ipv4 ipv6 eb' -- "$cur" ) ) ;; + --add-protocol|--remove-protocol|--query-protocol) + COMPREPLY=( $( compgen -W '`getent protocols | cut -d " " -f 1`' -- "$cur" ) ) + ;; + --set-target) + if [[ ${words[@]} == *--policy=* ]]; then + COMPREPLY=( $( compgen -W 'CONTINUE ACCEPT DROP REJECT' -- "$cur" ) ) + else + COMPREPLY=( $( compgen -W 'default ACCEPT DROP REJECT' -- "$cur" ) ) + fi + ;; + --set-log-denied) + COMPREPLY=( $( compgen -W 'all unicast broadcast multicast off' -- "$cur" ) ) + ;; ipv4|ipv6|eb) if [[ ${words[@]} == *--passthrough* ]]; then return 0 @@ -231,11 +294,11 @@ _firewall_cmd() ;; *) if [[ "$cur" == -* ]]; then - if [[ ${words[@]} == *--new-ipset* ]]; then - COMPREPLY=( $( compgen -W "${OPTIONS_NEW_IPSET}" -- "$cur") ) - else - COMPREPLY=( $( compgen -W "${OPTIONS_GENERAL}" -- "$cur") ) - fi + if [[ ${words[@]} == *--new-ipset* ]]; then + COMPREPLY=( $( compgen -W "${OPTIONS_NEW_IPSET}" -- "$cur") ) + else + COMPREPLY=( $( compgen -W "${OPTIONS_GENERAL}" -- "$cur") ) + fi fi ;; esac -- 2.36.1

2 1

[PATCH 1/3] docs: minor typo: missing equals after --set-priority
by Olav Reinert 01 Jun '22

01 Jun '22

--- doc/xml/firewall-cmd.xml.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/xml/firewall-cmd.xml.in b/doc/xml/firewall-cmd.xml.in index 4fbcbc3b..34a30e5e 100644 --- a/doc/xml/firewall-cmd.xml.in +++ b/doc/xml/firewall-cmd.xml.in @@ -1062,7 +1062,7 @@ </varlistentry> <varlistentry> - <term><option>--permanent</option> <option>--policy</option>=<replaceable>policy</replaceable> <option>--set-priority</option><replaceable>priority</replaceable></term> + <term><option>--permanent</option> <option>--policy</option>=<replaceable>policy</replaceable> <option>--set-priority</option>=<replaceable>priority</replaceable></term> <listitem> <para> Set the priority. The priority determines the relative ordering of -- 2.36.1

2 3

[PATCH] bash completion: add missing status options
by seroton10＠gmail.com 31 May '22

31 May '22

2 1

Problems using fw.reload and fw.complete_reload
by Angelo Naselli 06 Jan '22

06 Jan '22

Hi, I'm experiencing a problem using firewall reload either from firewall-config or firewall-cmd: $ firewall-cmd --reload Error: COMMAND_FAILED: 'python-nftables' failed: internal:0:0-0: Error: Could not process rule: Operazione non supportata internal:0:0-0: Error: Could not process rule: Operazione non supportata internal:0:0-0: Error: Could not process rule: Operazione non supportata internal:0:0-0: Error: Could not process rule: File o directory non esistente internal:0:0-0: Error: Could not process rule: File o directory non esistente internal:0:0-0: Error: Could not process rule: File o directory non esistente JSON blob: {"nftables": [{"metainfo": {"json_schema_version": 1}}, {"add": {"table": {"family": "inet", "name": "firewalld_policy_drop"}}}, {"add": {"chain": {"family": "inet", "table": "firewalld_policy_drop", "name": "filter_input", "type": "filter", "hook": "input", "prio": 9, "policy": "drop"}}}, {"add": {"chain": {"family": "inet", "table": "firewalld_policy_drop", "name": "filter_forward", "type": "filter", "hook": "forward", "prio": 9, "policy": "drop"}}}, {"add": {"chain": {"family": "inet", "table": "firewalld_policy_drop", "name": "filter_output", "type": "filter", "hook": "output", "prio": 9, "policy": "drop"}}}, {"add": {"rule": {"family": "inet", "table": "firewalld_policy_drop", "chain": "filter_input", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["established", "related"]}}}, {"accept": null}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld_policy_drop", "chain": "filter_forward", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["established", "related"]}}}, {"accept": null}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld_policy_drop", "chain": "filter_output", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["established", "related"]}}}, {"accept": null}]}}}]} Readme file says python3-nftables >= 0.9.4 i have nftables-1.0.0 any ideas? TIA Angelo

2 2

[PATCH firewalld] feat: service: add nbd (Network Block Device) service
by Richard W.M. Jones 13 Aug '20

13 Aug '20

--- config/Makefile.am | 1 + config/services/nbd.xml | 6 ++++++ po/POTFILES.in | 1 + 3 files changed, 8 insertions(+) diff --git a/config/Makefile.am b/config/Makefile.am index 61021285..956aba51 100644 --- a/config/Makefile.am +++ b/config/Makefile.am @@ -204,6 +204,7 @@ CONFIG_FILES = \ services/ms-wbt.xml \ services/murmur.xml \ services/mysql.xml \ + services/nbd.xml \ services/nfs.xml \ services/nfs3.xml \ services/nmea-0183.xml \ diff --git a/config/services/nbd.xml b/config/services/nbd.xml new file mode 100644 index 00000000..f02edefc --- /dev/null +++ b/config/services/nbd.xml @@ -0,0 +1,6 @@ +<?xml version="1.0" encoding="utf-8"?> +<service> + <short>NBD</short> + <description>Network Block Device (NBD) is a high-performance protocol for exporting disk images between machines.</description> + <port protocol="tcp" port="10809"/> +</service> diff --git a/po/POTFILES.in b/po/POTFILES.in index ed5be3e2..fdd40572 100644 --- a/po/POTFILES.in +++ b/po/POTFILES.in @@ -137,6 +137,7 @@ config/services/mssql.xml config/services/ms-wbt.xml config/services/murmur.xml config/services/mysql.xml +config/services/nbd.xml config/services/nfs3.xml config/services/nfs.xml config/services/nmea-0183.xml -- 2.28.0.rc2

4 6

Include other services in a service definition
by Michael Anckaert 04 Jan '18

04 Jan '18

Hello everyone I wanted to check with the developers here on whether this would be a good idea / desirable. Something I have ran into myself and have seen on various channels is the request to add a service 'link' to the definition of a service. A recent ticket on Github gives a perfect example of this: https://github.com/firewalld/firewalld/issues/ A rough example such a service definition could be that instead of having this <?xml version="1.0" encoding="utf-8"?> <service> <short>Red Hat Satellite 6</short> <description>Red Hat Satellite 6 ...</description> <port protocol="tcp" port="53"/> <port protocol="udp" port="53"/> <port protocol="udp" port="67-69"/> <port protocol="tcp" port="80"/> ... </service> We could have this <?xml version="1.0" encoding="utf-8"?> <service> <short>Red Hat Satellite 6</short> <description>Red Hat Satellite 6 ...</description> <service name="dns" /> <service name="http" /> <port protocol="udp" port="67-69"/> </service> I would like to contribute some development time on this but wanted to check here first if this is something that would be accepted or what the general feeling is for this functionality. Kind regards Michael

2 1

oVirt firewalld services
by Leon Goldberg 28 Apr '17

28 Apr '17

Hey, We're looking to start making use of firewalld in oVirt. I've gathered a list of the missing services, and would like your take on which services should be provided by firewalld and which should be provided by the relevant 3rd parties. ovirt-imageio (tcp/54322, PR: github.com/t-woerner/firewalld/pull/212/) serial consoles (tcp/2223) ovn host tunnels (udp/6081) gluster swift (tcp/8080) tcp/39543, tcp/55863 ("status") -- gluster ports nlockmgr (udp/963, tcp/965) ctdbd (tcp/4379) nrpe (tcp/5666) Some of the ports aren't standardized and their name only serves as an indication to their use in oVirt; we'd like to know how to treat those as well in your opinions. Thanks, Leon

3 3

What are default rules used for ? What's the result to remove them ?
by youwentao1＠huawei.com 21 Mar '17

21 Mar '17

I find that there are fix coded in firewalld that many default rules (and chains) that are meaning less, such as all ip in and all ip out in security iptable table. Why are they existed ? Can we remove them ? And I also find that the network performance will be improved if I rmmod some kernel modules, i.e. iptable_mangle.ko, iptable_security.ko. And for SuSEfirewall, there is NO such kos inserted. Why firewalld inserted them fixedly ? Will function be developed to dynamically remove such kos ?

1 0

[PATCH] Adds Point-to-Point Tunneling Protocol (PPTP) as a service.
by poma 06 Mar '17

06 Mar '17

From 31d95ae0e979ad73953b7ebadba7855f1bb3896d Mon Sep 17 00:00:00 2001 From: poma <poma(a)gmail.com> Date: Mon, 6 Mar 2017 11:00:45 +0100 Subject: [PATCH] Adds Point-to-Point Tunneling Protocol (PPTP) as a service. By enabling service, specific helpers modules will be attached, to achieve the operational state of service. --- config/Makefile.am | 1 + config/services/pptp.xml | 8 ++++++++ po/POTFILES.in | 1 + 3 files changed, 10 insertions(+) create mode 100644 config/services/pptp.xml diff --git a/config/Makefile.am b/config/Makefile.am index f05caf6..bb33846 100644 --- a/config/Makefile.am +++ b/config/Makefile.am @@ -181,6 +181,7 @@ CONFIG_FILES = \ services/pop3s.xml \ services/pop3.xml \ services/postgresql.xml \ + services/pptp.xml \ services/privoxy.xml \ services/proxy-dhcp.xml \ services/ptp.xml \ diff --git a/config/services/pptp.xml b/config/services/pptp.xml new file mode 100644 index 0000000..c055973 --- /dev/null +++ b/config/services/pptp.xml @@ -0,0 +1,8 @@ +<?xml version="1.0" encoding="utf-8"?> +<service> + <short>PPTP</short> + <description>Point-to-Point Tunneling Protocol (PPTP) is a method for implementing Virtual Private Network (VPN). If you plan to allow compatible Microsoft VPN clients to connect to an internal firewalled network, enable this option. You need the pptpd package installed for this option to be useful.</description> + <port protocol="tcp" port="1723"/> + <port protocol="udp" port="1723"/> + <module name="nf_conntrack_pptp"/> +</service> diff --git a/po/POTFILES.in b/po/POTFILES.in index 12cdbf2..fd9137d 100644 --- a/po/POTFILES.in +++ b/po/POTFILES.in @@ -31,6 +31,7 @@ config/services/nfs.xml config/services/ntp.xml config/services/openvpn.xml config/services/pop3s.xml +config/services/pptp.xml config/services/radius.xml config/services/samba-client.xml config/services/samba.xml -- 2.7.4

2 1

conntrack: generic helper won't handle protocol 47
by poma 01 Mar '17

01 Mar '17

Hello there, "... Please consider loading the specific helper module." $ grep 47 /etc/protocols gre 47 GRE # Generic Routing Encapsulation https://en.wikipedia.org/wiki/Generic_Routing_Encapsulation "In conjunction with PPTP to create VPNs." = Brief analysis and diagnosis: - Point-to-Point Tunneling Protocol (PPTP) Client: $ firewall-cmd --version 0.4.4.3 $ pptp --version pptp version 1.9.0 $ nmcli --version nmcli tool, version 1.7.1-0.9.20170224git9138967.fc24 $ firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p gre -j ACCEPT success $ firewall-cmd --reload success $ nmcli connection up pptp ifname enp2s5 Error: Connection activation failed: the VPN service stopped unexpectedly. $ journalctl -b -u NetworkManager.service -o cat [...] LCP: timeout sending Config-Requests LCP: timeout sending Config-Requests ** Message: nm-pptp-ppp-plugin: (nm_phasechange): status 11 / phase 'disconnect' Connection terminated. - PoPToP Point to Point Tunneling Server: $ firewall-cmd --version 0.4.4.3 $ pptpd --version pptpd v1.4.0 $ systemctl is-active firewalld pptpd active active $ firewall-cmd --get-automatic-helpers yes $ firewall-cmd --list-ports [...] 1723/tcp $ grep -a pptp /var/log/firewalld 2017-02-27 19:58:41 DEBUG1: nf_conntrack_pptp: pptp 2017-02-27 19:58:41 DEBUG1: Loading helper file '/usr/lib/firewalld/helpers/pptp.xml' 2017-02-27 19:58:41 DEBUG1: config.HelperAdded('pptp') $ dmesg -T | grep conntrack [Mon Feb 27 19:58:40 2017] nf_conntrack version 0.5.0 (16384 buckets, 65536 max) [Mon Feb 27 19:59:05 2017] conntrack: generic helper won't handle protocol 47. Please consider loading the specific helper module. = Conclusion: As already concluded, what is needed: # modprobe nf_conntrack_pptp # modinfo nf_conntrack_pptp | grep 'description\|depends' description: Netfilter connection tracking helper module for PPTP depends: nf_conntrack,nf_conntrack_proto_gre OR perhaps, how proto GRE is set on PPTP Client, to do the same on PTPP Server: $ firewall-cmd --direct --get-all-rules ipv4 filter INPUT 0 -p gre -j ACCEPT OR leave as is - for security's sake; "PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead." http://poptop.sourceforge.net/dox/protocol-security.phtml Ref. "netfilter: conntrack: disable generic tracking for known protocols" https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/net/… "netfilter: conntrack: warn the user if there is a better helper to use" https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/net/… "LCP: timeout sending Config-Requests" http://pptpclient.sourceforge.net/howto-diagnosis.phtml#lcp_timeout

1 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-devel