<HTML>
I just noticed something odd which I had not seen discussed anywhere, so i figured I would post here.<br>
<br>
Recently I just added and have been setting up Shorewall on my mythtv backend. I opened the needed ports (6543-TCP, 6544-TCP, 3306-TCP) mentioned in the mythtv documentation, but I still had issues connecting to the BE when my FE booted up.<br>
<br>
I looked at my shorewall logs, and noticed these entries:<br>
Dec 21 14:01:41 mainserver Shorewall:net2all:DROP:IN=eth0 OUT= MAC=XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX SRC=192.168.1.202 DST=192.168.1.200 LEN=84 TOS=0x00 PREC=0x00 TTL=3 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=10517 SEQ=1<br>
Dec 21 14:01:51 mainserver Shorewall:net2all:DROP:IN=eth0 OUT= MAC=XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:X0 SRC=192.168.1.202 DST=192.168.1.200 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=11029 SEQ=1<br>
<br>
After a little digging, it looks like my FE was attempting to ping (PROTO=ICMP) my BE during the startup process. The FE did not like these packets being dropped and would give the "standard" cannot connect to the BE message.<br>
<br>
I was able to overcome this by added this rule to /etc/shorewall/rules:<br>
Ping/ACCEPT net fw<br>
<br>
Anyone else running a firewall on their BE ever have to handle this? I would assume that any BE that uses an IPTABLES based firewall would need to do something similar? Maybe the default setting is to allow pings.<br>
<br>
Just curious.<br>
<br>
Mike<br>
<br>
</HTML>