ipcop-devel Mailing List for IPCop Firewall

There's an easy way to diagnose what's happening.  Login to IPCop as 
root via ssh or via a real console and issue the command:

tcpdump -s 0 -i eth0 port 53

tcpdump will dump the full (-s 0) packets received or sent on (port 
53) - DNS at its interface (-i eth0).  If your green network is not 
on eth0, you may have to change the -i option.

Then bring up IE or whatever and try to go to www or whatever and see 
what the resulting domain name is.  Use Ctl-C to kill tcpdump.

Harry
At 1:14 AM +0100 6/30/03, Matthew Dale wrote:
>  > At 5:19 PM +0100 6/29/03, st...@wo... wrote:
>>  >On 29.06.2003 16:35 Matthew Dale wrote:
>>  >>Issue number 1: Local DNS
>>  >>Many people seem to have difficulty in getting to ipcop via
>>  >>http://ipcop:81 as stated in the manual - I am among these people.
>>  >>I'm using DHCP to set clients up - and the dns server is set as IPCop
>>  >>as it should be. However, all I get is 404s trying to access like
>>  >>that, and ping can't ping it either - leaving me with
>>  >>http://192.168.0.1:81 as the only surefire way to access it.
>>  >>I have recieved a couple of workaround, one of which in particular
>>  >>poses questions about how the lookup is handled.
>>  >>The first workaround is to set the DNS Suffix to mydomain.home (or
>>  >>something similar) and add a line "192.168.0.1 ipcop.mydomain.home" to
>>  >>/etc/hosts on the IPCop box. This works fine - it pings, and the
>>  >>browser can see it.
>>  >
>>  >I would have thought that you should be doing this anyway. I always have
>
>Maybe I should. I was just curious as to why it didn't work "as advertised".
>
>>  Both Windows and Mac OS X have a different way they do DNS lookups
>>  from the Unix/Linux systems of the world, if they see a name with no
>>  periods.  Unix/Linux will try any name with or without periods before
>>  they append the DNS suffix to it while Windows and Mac OS X
>>  immediately append the suffix.  In other words, a Unix box will first
>>  send a query for "ipcop" and then for "ipcop.mydomain.home", while
>>  Windows and Mac will never send the query for ipcop.  Adding a period
>>  makes everyone happy.
>>
>>  BTW, if you make a typo and try to browse "www.ipcop.orgg", everyone
>>  will first try "www.ipcop.orgg" and then
>>  "www.ipcop.orgg.mydowmain.home".
>
>So basicly, it would work fine on a *nix machine - ok, I can live with that
>and add to my grumble-list for windows and networking...
>
>>  >>
>>  >>Issue number 2: Global DNS Suffixes
>>  >>As I said above in the first workaround, DNS suffixs work fine for me
>>  >>locally.
>>  >>However, global ones don't. Here is a test case I just ran.
>>  >>I set the DNS suffix to "bbc.co.uk". I renewed my DHCP lease and
>>  >>checked that the new settings had come through. I then flushed the DNS
>>  >>cache on the box I was using to test the suffix to remove any chance
>>  >>of it using a precached result.
>>  >>With this setup, requesting "www" should get me http://www.bbc.co.uk,
>>  >>and requesting "news" should get me http://news.bbc.co.uk, and so on.
>>  >>Not so. any request that relies on the suffix results in a 404.
>>  >>However, an inspection of the local DNS cache after the request
>>  >>reveals an entry like:
>>  >>news
>>  >
>>  >Are you running a web proxy, if so it might not work, since you
>>  >would look for news and so might the proxy.
>>  >If domain name was not defaulted on the proxy then the it would look for
>news.
>>  >Just an idea.
>I've tried it with squid on (transparent), on ('normal'), and off. I flushed
>the local DNS cache and restarted IPCop before testing in each mode. I got
>identical results in all modes - the DNS lookup would be sucessfully
>recieved by the local machine but the browser would still 404. In all modes,
>it worked for all other services.
>In fact, I did a bit more testing, and here's where it gets odd. I tried
>this at the windows command prompt:
>telnet www 80
>I was expecting a destination unreachable error or something, but instead it
>connected. Hitting enter resulted in what I'd expect to happen if I'd typed
>the full address myself (I got the HTML for the "bad request" response
>spewed down the screen because I'd not specified any HTTP header before
>sending the CR). So it works at the lowest level - I guess there's something
>up at the API level - still sufficiently low level that it's used by both
>Mozilla and IE, but abstracted enough that using telnet circumvents it.
>Yet another thing to add to the windows grumble list then.
>>  >
>>  >Why not net the domain and be done with it?
>The people who will be using the system are used to being able to type
>"mail" etc and being directed straight to thier webmail login. I'll just
>have to sort out the local hosts files.
>
>>  >
>>  ><me thinks out aloud>
>>  >Maybe people who 'know' about networking are setting the domain
>>  >without thinking about it, whereas those we problems are not.
>>  ></me thinks out aloud>
>>
>>  This sounds like you're not getting the DNS domain set properly on
>>  the machine doing the browsing and are you sure you didn't type
>>  "news."?
>>
>>  Harry
>
>I definately didn't. I tried it later out of interest, but during the
>testing I didn't use a trailing period.
>Ah well, it looks like IPcop is functioning perfectly and windows is just
>being irregular as usual. Maybe there should be a section added to the FAQ
>on this, detailing both workarounds?
>
>Thanks for your responses anyway.
>
>
>
>
>-------------------------------------------------------
>This SF.Net email sponsored by: Free pre-built ASP.NET sites including
>Data Reports, E-commerce, Portals, and Forums are available now.
>Download today and enter to win an XBOX or Visual Studio .NET.
>http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
>_______________________________________________
>IPCop-devel mailing list
>IPC...@li...
>https://lists.sourceforge.net/lists/listinfo/ipcop-devel

Regaring the bug in fix #2 there's a link on the download page to the=20
following message:

 > 2003-05-17 18:02:07
 > A fix for this will be issued shortly, but in the meantime, if you
 > want to to fix it by hand, log into a console on IPCop and execute
 > these commands: [...]

So how about this fix #3?

Cheers,
--=20
Michael A. G=FCtlbauer
http://www.guetlbauer.com/

Hi Guy,

Excerpt for my logs showing automatic reconnections (except for 06:40, which
was manual)
During this time there were no ADSL sync losses. When I looked at the web
interface,
it was showing "connecting", even though my max retries was set to 10, and
should have
given up a long time before then. I can spot nothing different in the logs
to any of the other
timeouts, where they system was able to reconnect.

NB for list: Not only am I using the new PULSAR driver, but also a couple of
mod's Guy came
up with. I am also running both fixes and the permissions reset on
restartsquid.

Regards,

Marco

============================================
00:03:08 ipcop PPP has gone down on ppp0
00:03:15 ipcop PPP has gone up on ppp0
00:20:01 ipcop NTP synchronisation event
00:54:46 ipcop PPP has gone down on ppp0
00:54:53 ipcop PPP has gone up on ppp0
01:00:53 ipcop PPP has gone down on ppp0
01:01:20 ipcop PPP has gone up on ppp0
01:20:01 ipcop NTP synchronisation event
02:14:16 ipcop PPP has gone down on ppp0
06:40:50 ipcop Dialing Mailbox ADSL.
06:41:06 ipcop PPP has gone up on ppp0
06:45:01 ipcop NTP synchronisation event
07:28:09 ipcop PPP has gone down on ppp0
07:28:15 ipcop PPP has gone up on ppp0
07:29:15 ipcop PPP has gone down on ppp0
07:29:25 ipcop PPP has gone up on ppp0
07:45:01 ipcop NTP synchronisation event
08:18:07 ipcop PPP has gone down on ppp0
08:18:14 ipcop PPP has gone up on ppp0
08:45:01 ipcop NTP synchronisation event
09:13:30 ipcop PPP has gone down on ppp0
09:13:42 ipcop PPP has gone up on ppp0
09:23:09 ipcop PPP has gone down on ppp0
09:23:15 ipcop PPP has gone up on ppp0
09:45:01 ipcop NTP synchronisation event
============================================
07:29:14 pppd No response to 2 echo-requests
07:29:14 pppd Serial link appears to be disconnected.
07:29:14 pppd Connection terminated.
07:29:14 pppd Connect time 1.0 minutes.
07:29:14 pppd Sent 2423 bytes, received 2769 bytes.
07:29:19 pppd ioctl(TIOCSETD, N_TTY): Interrupted system call
07:29:20 pppd Using interface ppp0
07:29:20 pppd Connect: ppp0 <--> /dev/ttyG0
07:29:24 pppd local IP address 212.18.239.97
07:29:24 pppd remote IP address 217.41.213.202
07:29:24 pppd primary DNS address 195.82.96.40
07:29:24 pppd secondary DNS address 195.82.96.6
=============================================

Hi Guy,

I swapped out my firewall hardware this weekend for a more standard box with
a standard power supply, and so far, I haven't lost line sync. It has
dropped the connection a few times (looks like LCP timeouts) but IT HAS
RECONNECTED AUTOMATICALLY !!! Not every time, but often enough to make me
wonder if there are two different problems regarding the pppd reconnection.

Anyway, I changed hardware because of an article I read about some power
supplies interfering with the ADSL signal. As something has made a
difference, this must figure high on the list of suspects.

I have both your mods on the box (all I did was move the hard drive over and
reconfigure the GREEN network card).

I'll give you some more feedback in a couple of days.

Regards,

Marco.

----- Original Message -----
From: "Guy Ellis" <gu...@tr...>
To: "George F. Saxby" <ge...@go...>
Cc: <ipc...@li...>
Sent: Monday, June 30, 2003 12:29 AM
Subject: Re: [IPCop-devel] New pulsar driver


> Hi George,
>
> Thanks for the feedback.
>
> What problems are have you experienced with the new driver (v3.2.4)?
>
> The v3.2.4 driver should fix the sync loss problems some have experienced
> with IPCop 1.3.
>
> However there is still a pppd problem with 1.3. I have 2 patches that you
> can try if you would like.
>
> Cheers,
>
>   - Guy.
>
> At 01:33 pm 29/06/2003 +0100, you wrote:
> >Thanks Guy,
> >     I have installed the new driver for the card and it all so far has
gone
> >smoothly with fixes 1 & 2 and the hand crafted  squid patch in place.
> >  The system  has not been as bad as Marco's but it has had its moments .
> >The great news is  another Pulsar was used where no other ADSL device
would
> >work which has won a lot of praise from it's delighted owners.
> >  Keep up the good work.
> >
> >  Question:-
> >  I saw a long time back mention of a PCI based 4 port network hub that
was
> >hailed as being useful for those of us with Shuttle IPCop boxes. Anybody
> >remember the details? Google has not helped on this occassion:-{
> >TIA
> >--
> >Bandiera tuxa trionfera,
> >Evviva il penguin e la liberta
> >www.saltmine.org.uk
> >
> >                George F. Saxby
> >
> >
> >
> >-------------------------------------------------------
> >This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> >Data Reports, E-commerce, Portals, and Forums are available now.
> >Download today and enter to win an XBOX or Visual Studio .NET.
> >http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
> >_______________________________________________
> >IPCop-devel mailing list
> >IPC...@li...
> >https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>
> ------------------------------------------------------------------
> Guy Ellis
> gu...@tr...
>
> Traverse Technologies
> ABN 98 078 657 324
> 652 Smith St.,
> Clifton Hill, Victoria, 3068
> AUSTRALIA
> http://www.traverse.com.au
> Tel (+613) 9486 7775
> Fax (+613) 9482 7754
> Mobile 0419 398 234
> ------------------------------------------------------------------
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>

> At 5:19 PM +0100 6/29/03, st...@wo... wrote:
> >On 29.06.2003 16:35 Matthew Dale wrote:
> >>Issue number 1: Local DNS
> >>Many people seem to have difficulty in getting to ipcop via
> >>http://ipcop:81 as stated in the manual - I am among these people.
> >>I'm using DHCP to set clients up - and the dns server is set as IPCop
> >>as it should be. However, all I get is 404s trying to access like
> >>that, and ping can't ping it either - leaving me with
> >>http://192.168.0.1:81 as the only surefire way to access it.
> >>I have recieved a couple of workaround, one of which in particular
> >>poses questions about how the lookup is handled.
> >>The first workaround is to set the DNS Suffix to mydomain.home (or
> >>something similar) and add a line "192.168.0.1 ipcop.mydomain.home" to
> >>/etc/hosts on the IPCop box. This works fine - it pings, and the
> >>browser can see it.
> >
> >I would have thought that you should be doing this anyway. I always have

Maybe I should. I was just curious as to why it didn't work "as advertised".

> Both Windows and Mac OS X have a different way they do DNS lookups
> from the Unix/Linux systems of the world, if they see a name with no
> periods.  Unix/Linux will try any name with or without periods before
> they append the DNS suffix to it while Windows and Mac OS X
> immediately append the suffix.  In other words, a Unix box will first
> send a query for "ipcop" and then for "ipcop.mydomain.home", while
> Windows and Mac will never send the query for ipcop.  Adding a period
> makes everyone happy.
>
> BTW, if you make a typo and try to browse "www.ipcop.orgg", everyone
> will first try "www.ipcop.orgg" and then
> "www.ipcop.orgg.mydowmain.home".

So basicly, it would work fine on a *nix machine - ok, I can live with that
and add to my grumble-list for windows and networking...

> >>
> >>Issue number 2: Global DNS Suffixes
> >>As I said above in the first workaround, DNS suffixs work fine for me
> >>locally.
> >>However, global ones don't. Here is a test case I just ran.
> >>I set the DNS suffix to "bbc.co.uk". I renewed my DHCP lease and
> >>checked that the new settings had come through. I then flushed the DNS
> >>cache on the box I was using to test the suffix to remove any chance
> >>of it using a precached result.
> >>With this setup, requesting "www" should get me http://www.bbc.co.uk,
> >>and requesting "news" should get me http://news.bbc.co.uk, and so on.
> >>Not so. any request that relies on the suffix results in a 404.
> >>However, an inspection of the local DNS cache after the request
> >>reveals an entry like:
> >>news
> >
> >Are you running a web proxy, if so it might not work, since you
> >would look for news and so might the proxy.
> >If domain name was not defaulted on the proxy then the it would look for
news.
> >Just an idea.
I've tried it with squid on (transparent), on ('normal'), and off. I flushed
the local DNS cache and restarted IPCop before testing in each mode. I got
identical results in all modes - the DNS lookup would be sucessfully
recieved by the local machine but the browser would still 404. In all modes,
it worked for all other services.
In fact, I did a bit more testing, and here's where it gets odd. I tried
this at the windows command prompt:
telnet www 80
I was expecting a destination unreachable error or something, but instead it
connected. Hitting enter resulted in what I'd expect to happen if I'd typed
the full address myself (I got the HTML for the "bad request" response
spewed down the screen because I'd not specified any HTTP header before
sending the CR). So it works at the lowest level - I guess there's something
up at the API level - still sufficiently low level that it's used by both
Mozilla and IE, but abstracted enough that using telnet circumvents it.
Yet another thing to add to the windows grumble list then.
> >
> >Why not net the domain and be done with it?
The people who will be using the system are used to being able to type
"mail" etc and being directed straight to thier webmail login. I'll just
have to sort out the local hosts files.

> >
> ><me thinks out aloud>
> >Maybe people who 'know' about networking are setting the domain
> >without thinking about it, whereas those we problems are not.
> ></me thinks out aloud>
>
> This sounds like you're not getting the DNS domain set properly on
> the machine doing the browsing and are you sure you didn't type
> "news."?
>
> Harry

I definately didn't. I tried it later out of interest, but during the
testing I didn't use a trailing period.
Ah well, it looks like IPcop is functioning perfectly and windows is just
being irregular as usual. Maybe there should be a section added to the FAQ
on this, detailing both workarounds?

Thanks for your responses anyway.

Hi George,

Thanks for the feedback.

What problems are have you experienced with the new driver (v3.2.4)?

The v3.2.4 driver should fix the sync loss problems some have experienced 
with IPCop 1.3.

However there is still a pppd problem with 1.3. I have 2 patches that you 
can try if you would like.

Cheers,

  - Guy.

At 01:33 pm 29/06/2003 +0100, you wrote:
>Thanks Guy,
>     I have installed the new driver for the card and it all so far has gone
>smoothly with fixes 1 & 2 and the hand crafted  squid patch in place.
>  The system  has not been as bad as Marco's but it has had its moments .
>The great news is  another Pulsar was used where no other ADSL device would
>work which has won a lot of praise from it's delighted owners.
>  Keep up the good work.
>
>  Question:-
>  I saw a long time back mention of a PCI based 4 port network hub that was
>hailed as being useful for those of us with Shuttle IPCop boxes. Anybody
>remember the details? Google has not helped on this occassion:-{
>TIA
>--
>Bandiera tuxa trionfera,
>Evviva il penguin e la liberta
>www.saltmine.org.uk
>
>                George F. Saxby
>
>
>
>-------------------------------------------------------
>This SF.Net email sponsored by: Free pre-built ASP.NET sites including
>Data Reports, E-commerce, Portals, and Forums are available now.
>Download today and enter to win an XBOX or Visual Studio .NET.
>http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
>_______________________________________________
>IPCop-devel mailing list
>IPC...@li...
>https://lists.sourceforge.net/lists/listinfo/ipcop-devel

------------------------------------------------------------------
Guy Ellis
gu...@tr...

Traverse Technologies
ABN 98 078 657 324
652 Smith St.,
Clifton Hill, Victoria, 3068
AUSTRALIA
http://www.traverse.com.au
Tel (+613) 9486 7775
Fax (+613) 9482 7754
Mobile 0419 398 234
------------------------------------------------------------------

> ----- Message from ge...@go... ---------
>
>  Question:-
>  I saw a long time back mention of a PCI based 4 port network hub that was
> hailed as being useful for those of us with Shuttle IPCop boxes. Anybody
> remember the details? Google has not helped on this occassion:-{

We can get them off the shelf in New Zealand:
http://dse.resultspage.com/search.php?w=XH7914

- Mike :-)

Hi,

I'm trying to get my bluetooth adaptor (usb) to work with ipcop.
(and use a ppp link from my laptop to the ipcop box)

I have 1 problem at this point (and foresee a second)
To get my hardware running i need to rebuild the kernel that comes with 
ipcop.
I downloaded a vanilla 2.4.21 from kernel.org.

But when i compile it , i get all sorts of errors when booting it, mostly 
missing modules.
Can i download the config file used for the 1.3beta1 kernel somewhere?
this would greatly easy the work for me.

The bluetooth driver i use is the bluez (bluez.sf.net) one, i just used the 
rpm versions of all packages that i needed, this works, the device is up, i 
can see my other bluetooth device and get a connection to.
Routing the traffic fails though (cannot even make a connection into the 
ipcop box), i think it has to do with the fact that i make a ppp connection 
into the box (ppp0) and this will be stopped by the firewall? of maybe it 
just doesn't work because of the modules issues.

what i'm trying to say, is it possible (within a reasonble timeframe) to get 
this to work, if I have the config file for the kernel?
(because now i have to leave my desktop system running in order to internet 
on my laptop, and the ipcop is always on anyway)

kind regards,

koen

_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE* 
http://join.msn.com/?page=features/junkmail

At 5:19 PM +0100 6/29/03, st...@wo... wrote:
>On 29.06.2003 16:35 Matthew Dale wrote:
>>Issue number 1: Local DNS
>>Many people seem to have difficulty in getting to ipcop via
>>http://ipcop:81 as stated in the manual - I am among these people.
>>I'm using DHCP to set clients up - and the dns server is set as IPCop
>>as it should be. However, all I get is 404s trying to access like
>>that, and ping can't ping it either - leaving me with
>>http://192.168.0.1:81 as the only surefire way to access it.
>>I have recieved a couple of workaround, one of which in particular
>>poses questions about how the lookup is handled.
>>The first workaround is to set the DNS Suffix to mydomain.home (or
>>something similar) and add a line "192.168.0.1 ipcop.mydomain.home" to
>>/etc/hosts on the IPCop box. This works fine - it pings, and the
>>browser can see it.
>
>I would have thought that you should be doing this anyway. I always have

Both Windows and Mac OS X have a different way they do DNS lookups 
from the Unix/Linux systems of the world, if they see a name with no 
periods.  Unix/Linux will try any name with or without periods before 
they append the DNS suffix to it while Windows and Mac OS X 
immediately append the suffix.  In other words, a Unix box will first 
send a query for "ipcop" and then for "ipcop.mydomain.home", while 
Windows and Mac will never send the query for ipcop.  Adding a period 
makes everyone happy.

BTW, if you make a typo and try to browse "www.ipcop.orgg", everyone 
will first try "www.ipcop.orgg" and then 
"www.ipcop.orgg.mydowmain.home".

>>
>>Issue number 2: Global DNS Suffixes
>>As I said above in the first workaround, DNS suffixs work fine for me
>>locally.
>>However, global ones don't. Here is a test case I just ran.
>>I set the DNS suffix to "bbc.co.uk". I renewed my DHCP lease and
>>checked that the new settings had come through. I then flushed the DNS
>>cache on the box I was using to test the suffix to remove any chance
>>of it using a precached result.
>>With this setup, requesting "www" should get me http://www.bbc.co.uk,
>>and requesting "news" should get me http://news.bbc.co.uk, and so on.
>>Not so. any request that relies on the suffix results in a 404.
>>However, an inspection of the local DNS cache after the request
>>reveals an entry like:
>>news
>
>Are you running a web proxy, if so it might not work, since you 
>would look for news and so might the proxy.
>If domain name was not defaulted on the proxy then the it would look for news.
>Just an idea.
>
>Why not net the domain and be done with it?
>
><me thinks out aloud>
>Maybe people who 'know' about networking are setting the domain 
>without thinking about it, whereas those we problems are not.
></me thinks out aloud>

This sounds like you're not getting the DNS domain set properly on 
the machine doing the browsing and are you sure you didn't type 
"news."?

Harry

On 29.06.2003 16:35 Matthew Dale wrote:
> Issue number 1: Local DNS
> Many people seem to have difficulty in getting to ipcop via
> http://ipcop:81 as stated in the manual - I am among these people.
> I'm using DHCP to set clients up - and the dns server is set as IPCop
> as it should be. However, all I get is 404s trying to access like
> that, and ping can't ping it either - leaving me with
> http://192.168.0.1:81 as the only surefire way to access it.
> I have recieved a couple of workaround, one of which in particular
> poses questions about how the lookup is handled.
> The first workaround is to set the DNS Suffix to mydomain.home (or
> something similar) and add a line "192.168.0.1 ipcop.mydomain.home" to
> /etc/hosts on the IPCop box. This works fine - it pings, and the
> browser can see it.

I would have thought that you should be doing this anyway. I always have

> 
> Issue number 2: Global DNS Suffixes
> As I said above in the first workaround, DNS suffixs work fine for me
> locally.
> However, global ones don't. Here is a test case I just ran.
> I set the DNS suffix to "bbc.co.uk". I renewed my DHCP lease and
> checked that the new settings had come through. I then flushed the DNS
> cache on the box I was using to test the suffix to remove any chance
> of it using a precached result.
> With this setup, requesting "www" should get me http://www.bbc.co.uk,
> and requesting "news" should get me http://news.bbc.co.uk, and so on.
> Not so. any request that relies on the suffix results in a 404.
> However, an inspection of the local DNS cache after the request
> reveals an entry like:
> news

Are you running a web proxy, if so it might not work, since you would 
look for news and so might the proxy.
If domain name was not defaulted on the proxy then the it would look 
for news.
Just an idea.

Why not net the domain and be done with it?

<me thinks out aloud>
Maybe people who 'know' about networking are setting the domain without 
thinking about it, whereas those we problems are not.
</me thinks out aloud>

  --
'ooroo

stinga...(:)-)
---------------------------------------------------
Email: st...@wo...      o
You need only two tools.        o /////
A hammer and duct tape. If it    /@   `\  /) ~
doesn't move and it should,     >  (O)  X<  ~  Fish!!
use the hammer. If it moves and  `\___/'  \) ~
shouldn't, use the tape.           \\\
---------------------------------------------------

This is really two seperate issues, but they both seem to point to a =
fault in the same area.
Following a discussion (thread =
http://ipcop.no-ip.com/ipcsupport/modules.php?op=3Dmodload&name=3Dforums&=
file=3Dviewtopic&t=3D196 at unofficial IPCop support site) I've become =
interested in finding out just what is going on.

Issue number 1: Local DNS
Many people seem to have difficulty in getting to ipcop via =
http://ipcop:81 as stated in the manual - I am among these people.
I'm using DHCP to set clients up - and the dns server is set as IPCop as =
it should be. However, all I get is 404s trying to access like that, and =
ping can't ping it either - leaving me with http://192.168.0.1:81 as the =
only surefire way to access it.
I have recieved a couple of workaround, one of which in particular poses =
questions about how the lookup is handled.
The first workaround is to set the DNS Suffix to mydomain.home (or =
something similar) and add a line "192.168.0.1 ipcop.mydomain.home" to =
/etc/hosts on the IPCop box. This works fine - it pings, and the browser =
can see it.
The other, more interesting one, is to request http://ipcop.:81 (note =
the period between p and the colon). Why does this work? Is it that =
windows is trying to resolve http://ipcop as a windows networking =
location and not a TCP/IP address, and the period forces it to see the =
request as a domain request (and therefore ensuring it resolves using =
the TCP/IP systems)?

Issue number 2: Global DNS Suffixes
As I said above in the first workaround, DNS suffixs work fine for me =
locally.
However, global ones don't. Here is a test case I just ran.
I set the DNS suffix to "bbc.co.uk". I renewed my DHCP lease and checked =
that the new settings had come through. I then flushed the DNS cache on =
the box I was using to test the suffix to remove any chance of it using =
a precached result.
With this setup, requesting "www" should get me http://www.bbc.co.uk, =
and requesting "news" should get me http://news.bbc.co.uk, and so on. =
Not so. any request that relies on the suffix results in a 404. However, =
an inspection of the local DNS cache after the request reveals an entry =
like:
news
----------------------------------------
Record Name . . . . . : news.bbc.co.uk
Record Type . . . . . : 1
Time To Live  . . . . : 16272
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 212.58.226.30
So the suffix addition and subsequent DNS lookup was sucessful, but for =
some reason it was never passed to the browser.
Using dns suffixes works for all applications but webbrowsers. eg. =
ftping to "news" would work if I had access at news.bbc.co.uk - I have =
tested this with another location where I do have FTP access.

Now for the even odder bit - BOTH of these problems occur in both =
internet explorer AND mozilla win32. This points to a problem either at =
the windows API level, or with IPCop.

Does anyone have a clue what may be going on here?

Thanks Guy, 
    I have installed the new driver for the card and it all so far has gone 
smoothly with fixes 1 & 2 and the hand crafted  squid patch in place.
 The system  has not been as bad as Marco's but it has had its moments .
The great news is  another Pulsar was used where no other ADSL device would 
work which has won a lot of praise from it's delighted owners.
 Keep up the good work.

 Question:-
 I saw a long time back mention of a PCI based 4 port network hub that was 
hailed as being useful for those of us with Shuttle IPCop boxes. Anybody 
remember the details? Google has not helped on this occassion:-{
TIA
-- 
Bandiera tuxa trionfera,
Evviva il penguin e la liberta
www.saltmine.org.uk
           
               George F. Saxby
     

Hi,

> > Will IPCop be released with addonz in the distro?  At this point, no.
> > Our goal is to keep IPCop a small base firewall distro.  Yes, there  are
> > functions built in to help the general user that are needed in a
> > firewall -- DHCP, DNS functionally.  But the goal is keep the distro
> > small so it easy to down load and install.  If we colud get to be a  web
> > only install (like Gentoo is basiclly) that would be another
> > story.  Will we get there most likely not.
> 
> Would you consider making the add-onz framework part of the main
> distribution which would allow for easier and wider use of them? It is a
> similar idea to the plug-ins concept that SquirrelMail
> http://www.squirrelmail.org/ uses.

I want to have IPCop include an addonz system.  I would even like to make 
the base system modular.  There's no reason Snort, Squid, SSH, etc. should 
not be modular. 

But...  this requires a modular design from the ground up.  I will keep 
this in mind when doing the conversion to Python, but don't count on me 
getting it right the first time.  Until them, we'll stick to the current 
addonz system.

Kind regards,

Mark Wormgoor
-- 
***************************************************************
* |\    /|      |  /|  /       Mark Wormgoor                  *
* | \  / |      | / | /        mailto:ma...@wo...       *
* |  \/  |ark   |/  |/ormgoor  http://www.wormgoor.com/mark/  *
***************************************************************

As addonz was consived... This is an original request.  The issue is
user knowing where IPCop left off and addonz began.  I was one of the
people looking at the first addonz being but into place and suggested
that addonz first installed function (a boot strap for them) was a
hard to install installer.  This way the user knows they have left
IPCop based functions and now workin goutside the system... so if it
breaks -- IPCop can say, install IPCop and check again to validate.

The better answer what Bryan posted.  That is the correct solution. 
It is just most people do not want to use more than one machine.   

Maybe in the future VM systems will be a better option, then one
machine with multiple OS concurrently running, then all functions 
will
be in their own play pen.  That would be the best of both worlds...
but bigger than 20 meg distro.

Jack Beglinger


On 25 Jun 2003 at 14:09, Sam Snow wrote:

> > Jack B wrote:
> >
> > Will IPCop be released with addonz in the distro?  At this point,
> > no. Our goal is to keep IPCop a small base firewall distro.  Yes,
> > there  are functions built in to help the general user that are
> > needed in a firewall -- DHCP, DNS functionally.  But the goal is
> > keep the distro small so it easy to down load and install.  If we
> > colud get to be a  web only install (like Gentoo is basiclly) that
> > would be another story.  Will we get there most likely not.
> 
> Jack,
> Would you consider making the add-onz framework part of the main
> distribution which would allow for easier and wider use of them? It
> is a similar idea to the plug-ins concept that SquirrelMail
> http://www.squirrelmail.org/ uses.
> 
> Sam
> 
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: INetU
> Attention Web Developers & Consultants: Become An INetU Hosting
> Partner. Refer Dedicated Servers. We Manage Them. You Get 10%
> Monthly Commission! INetU Dedicated Managed Hosting
> http://www.inetu.net/partner/index.php
> _______________________________________________ IPCop-devel mailing
> list IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel

Sam Snow wrote:
> Jack,
> Would you consider making the add-onz framework part of the main
> distribution which would allow for easier and wider use of them? It is a
> similar idea to the plug-ins concept that SquirrelMail
> http://www.squirrelmail.org/ uses.

I have devoted 0 minutes to development of IPCop, so I readily admit my 
opinion really doesn't mean swat at this point.

But given the focus of the project, and various input from those who 
have, it is clear to me that many things would be better left to a 
separate, "sister box" in the DMZ.

Call it "IPJudge" if you will.  Throw a lot of the user-level components 
and capabilities people are asking for on it (proxy w/blocking, mail, 
DNS, etc...).  Leave IPCop itself with the kernel-level capabilities 
that you wouldn't want to bog down with those "IPJudge" user-level services.

Sure, IPCop itself has various user-level capabilities, but they are 
(and should stay) "minimal."  My viewpoint is that anything 
non-kernel/inspection-type on IPCop is only for people who just need one 
system and basic capabilities.  Anything that is more advanced should go 
on a dedicated system.


-- 
Bryan J. Smith, E.I.   b.j...@ie...   http://thebs.org
If you want the stupid letters:   http://thebs.org/certs.pdf
------------------------------------------------------------
Running Windows applications under Linux does not reduce any
political/legal "costs" but does increase the overall tech-
nical "costs."  Linux is not a better Windows than Windows.

> Jack B wrote:
>
> Will IPCop be released with addonz in the distro?  At this point, no.
> Our goal is to keep IPCop a small base firewall distro.  Yes, there  are
> functions built in to help the general user that are needed in a
> firewall -- DHCP, DNS functionally.  But the goal is keep the distro
> small so it easy to down load and install.  If we colud get to be a  web
> only install (like Gentoo is basiclly) that would be another
> story.  Will we get there most likely not.

Jack,
Would you consider making the add-onz framework part of the main
distribution which would allow for easier and wider use of them? It is a
similar idea to the plug-ins concept that SquirrelMail
http://www.squirrelmail.org/ uses.

Sam

On 25 Jun 2003 at 15:00, BONIFACE,ERIC (HP-France,ex1) wrote:

> of course I have check this URL, but it is not so clear regarding
> IPCOP evolution. And one of my question is to know if it is planned to
> put addons like standard packages (that is to say, included in the iso
> file).

Addonz are items that others believe are correct for a firewall and 
the IPCop does not time or do not want as part of base firewall.  You 
can view them as a separate development, that we are generally  
pleased about and but do not authorize or warrent.  It is great that 
others find the base of IPCop is a good platform to "improve apon".

Does addonz merge into the base IPCop? Yes, we find from time to time 
the people doing the addonz have placed important new functionality 
that is good for all.  There was a sub-group working on wireless 
(blue interface) that some of that work is finding it way into IPCop. 
 Generally, the person who did the work as addonz is the adding it to 
IPCop.

Will IPCop be released with addonz in the distro?  At this point, no. 
Our goal is to keep IPCop a small base firewall distro.  Yes, there 
are functions built in to help the general user that are needed in a 
firewall -- DHCP, DNS functionally.  But the goal is keep the distro 
small so it easy to down load and install.  If we colud get to be a 
web only install (like Gentoo is basiclly) that would be another 
story.  Will we get there most likely not.

Also our distro is a GPL pure distro.  We have issues with some DSL 
cards because of properity code, but we have documented how to get 
around.  Not all addonz are GPL - I believe Danguardian is not. So 
adding them into the distro both adds bloat to general use and makes 
it non-GPL pure.

"We have bloat today!", yes we know.  One such case is all the 
drivers for NICs, when one to three would be all any IPCop would 
need.  But how do you autoconfigure without all the drivers being 
available?  Currently, we have people (myself included) wanting a 
SCSI to be added.  My need is VMware ESX Server create virual VMs 
with SCSI not IDE drives.  But again this adds bloat to distro that 
for most users is not needed.  It is a balancing act.

If you have ideas of how to keep us under GPL, under 20Meg downloads 
and still have the add functionality of the addonz... we are 
listening.  But remember, we are a firewall: first, last, and always.

Jack Beglinger
Project Leader

Hi,

of course I have check this URL, but it is not so clear regarding IPCOP
evolution.
And one of my question is to know if it is planned to put addons like
standard packages (that is to say, included in the iso file).

Eric.

-----Message d'origine-----
De : ja...@gu... [mailto:ja...@gu...]
Envoy=E9 : mercredi 25 juin 2003 13:14
=C0 : ipc...@li...
Objet : Re: [IPCop-devel] IPCop future


http://ipcop.org/cgi-bin/twiki/view/IPCop/RoadMap

If you are wanting more faster, you have made the correct offer to=20
lend a hand.

jackb


On 25 Jun 2003 at 12:15, BONIFACE,ERIC (HP-France,ex1) wrote:

> Hi,
>=20
> in fact, I'd like to know what will be the next development steps.
>=20
> may be some configuration pages for iptables, squid, ... ?=20
> do you plan to add PCMCIA support in standard ? (will increase the
> range of IPCop compatible device) what's about new feature like time
> server (NTP), DansGuardian, IPBan, IPTraf and so on that already =
exist
> but like addons only, and that really increase IPCOP functionnality ?
> (can be option during installation phase). I think a lot of guys are
> currently using some (may be all?) of these addons....
>=20
> and so on... :-)
> of course, I am available to help ! :-)
>=20
> Eric.
>=20
> Eric Boniface - Hewlett Packard/HP PSG IT Ops
> --- Want to get a good firewall ? Check  http://www.ipcop.org
>=20
>=20
> -------------------------------------------------------
> This SF.Net email is sponsored by: INetU
> Attention Web Developers & Consultants: Become An INetU Hosting
> Partner. Refer Dedicated Servers. We Manage Them. You Get 10% Monthly
> Commission! INetU Dedicated Managed Hosting
> http://www.inetu.net/partner/index.php
> _______________________________________________ IPCop-devel mailing
> list IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>=20



-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting =
Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly =
Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
_______________________________________________
IPCop-devel mailing list
IPC...@li...
https://lists.sourceforge.net/lists/listinfo/ipcop-devel

Hi,

> I've just released a new Pulsar PCI ADSL driver for IPCop 1.3.
> 
> You can download it from...
> 
> http://adsl4linux.no-ip.org/download.html
> 
> This driver is version 3.2.4 which includes a new PCI firmware build U51107 
> with improved line sync stability.
> 
> Feedback on this version would be appreciated so I can put it up on the 
> Traverse web site.

Well, I've installed it and it works.  But I haven't been disconnected 
yet, so I'll let you know how that goes.

Kind regards,

Mark
-- 
***************************************************************
* |\    /|      |  /|  /       Mark Wormgoor                  *
* | \  / |      | / | /        mailto:ma...@wo...       *
* |  \/  |ark   |/  |/ormgoor  http://www.wormgoor.com/mark/  *
***************************************************************

http://ipcop.org/cgi-bin/twiki/view/IPCop/RoadMap

If you are wanting more faster, you have made the correct offer to 
lend a hand.

jackb


On 25 Jun 2003 at 12:15, BONIFACE,ERIC (HP-France,ex1) wrote:

> Hi,
> 
> in fact, I'd like to know what will be the next development steps.
> 
> may be some configuration pages for iptables, squid, ... ? 
> do you plan to add PCMCIA support in standard ? (will increase the
> range of IPCop compatible device) what's about new feature like time
> server (NTP), DansGuardian, IPBan, IPTraf and so on that already exist
> but like addons only, and that really increase IPCOP functionnality ?
> (can be option during installation phase). I think a lot of guys are
> currently using some (may be all?) of these addons....
> 
> and so on... :-)
> of course, I am available to help ! :-)
> 
> Eric.
> 
> Eric Boniface - Hewlett Packard/HP PSG IT Ops
> --- Want to get a good firewall ? Check  http://www.ipcop.org
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: INetU
> Attention Web Developers & Consultants: Become An INetU Hosting
> Partner. Refer Dedicated Servers. We Manage Them. You Get 10% Monthly
> Commission! INetU Dedicated Managed Hosting
> http://www.inetu.net/partner/index.php
> _______________________________________________ IPCop-devel mailing
> list IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
> 

Hi,

in fact, I'd like to know what will be the next development steps.

may be some configuration pages for iptables, squid, ... ? 
do you plan to add PCMCIA support in standard ? (will increase the range of
IPCop compatible device)
what's about new feature like time server (NTP), DansGuardian, IPBan, IPTraf
and so on that already exist but like addons only, and that really increase
IPCOP functionnality ? (can be option during installation phase). I think a
lot of guys are currently using some (may be all?) of these addons....

and so on... :-)
of course, I am available to help ! :-)

Eric.

Eric Boniface - Hewlett Packard/HP PSG IT Ops
--- Want to get a good firewall ? Check  http://www.ipcop.org

Hi All,

I've just released a new Pulsar PCI ADSL driver for IPCop 1.3.

You can download it from...

http://adsl4linux.no-ip.org/download.html

This driver is version 3.2.4 which includes a new PCI firmware build U51107 
with improved line sync stability.

Feedback on this version would be appreciated so I can put it up on the 
Traverse web site.

Cheers,

  - Guy.

------------------------------------------------------------------
Guy Ellis
gu...@tr...

Traverse Technologies
ABN 98 078 657 324
652 Smith St.,
Clifton Hill, Victoria, 3068
AUSTRALIA
http://www.traverse.com.au
Tel (+613) 9486 7775
Fax (+613) 9482 7754
Mobile 0419 398 234
------------------------------------------------------------------

Hi!

I've been able to reproduce the bug serveral times now, and think I
found exacly when it happens :-)

When you enter the dialup page the interface box is set to Modem, but
it's not selcted since there is noe thelephonenupmber box. Now to
reproduce the bug, do all your selections and press save. Then it vill
ask for tlephonenumber, fill it in and then press save again. You vill
see that there is nothing in the profile list.
This wil happen also if you select n other  type of interface if you
don't push the refresh button, when selecting the interface.
If you on the other hand, selects the interface and push the refresh
button first, an then fill in all the other information, you will avoid
the bug

RuS

lør, 21.06.2003 kl. 22.52 skrev Eric Oberlander:
> on 18/6/03 1:01 pm, Marco van Beek at mva...@su... wrote:
> 
> > Hi All,
> > 
> > I haven't seen this reported on the list, but I think there is a bug in 1.3
> > when saving the ppp profiles. It seems to save the settings file as
> > "setting-" without the number, and the profile list dropdown always shows
> > empty profiles.
> > 
> > As long as you only have one profile, it is fine, but if you set up a second
> > profile, it overwrites the first.
> > 
> > I think this may be to do with needing to select a profile before saving, as
> > the file saving routine uses a variable, which probably isn't set if you
> > start on a blank page. I think the line I mean is indicated below. If there
> > isn't a $pppsettings{'PROFILE'} variable set, it would be blank, causing
> > what I see when it saves the profile. The workaround isn't difficult, but
> > may be we need some additional error checking here asking people to select a
> > blank profile first, maybe?
> > 
> > ===========================
> > if ($errormessage) {
> > $pppsettings{'VALID'} = 'no'; }
> > else {
> > $pppsettings{'VALID'} = 'yes'; }
> > 
> > # write cgi vars to the file.
> >>>> &writehash("${swroot}/ppp/settings-$pppsettings{'PROFILE'}",
> > \%pppsettings);
> > 
> > # make link and write secret file.
> > &updatesettings();
> > &writesecrets();
> > 
> > &log("$tr{'profile saved'} $pppsettings{'PROFILENAME'}");
> > =============================
> > 
> > Regards
> > 
> > Marco van Beek
> > Supporting Role Ltd.
> 
> Hi
> 
> I can confirm this behaviour. Can I suggest adding this into the error
> checking when the action is 'save'?
> 
>     if ( $pppsettings{'PROFILE'} eq '') {
>         $errormessage = $tr{'select a profile'};
>         goto ERROR; }
> 
> and adding the translated phrase to en.pl (* required). You may want to pick
> a better error message, such as "Select a profile before saving" or "Select
> a profile first".
> 
> Anybody else like to test and confirm this?
> 
> Eric
> 
> (* It won't appear as an error with a blank errormessage string).
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: INetU
> Attention Web Developers & Consultants: Become An INetU Hosting Partner.
> Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
> INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
-- 
Runar Skraastad <ru...@ho...>

----- Original Message -----
From: "Eric Oberlander" <er...@ob...>
To: "Marco van Beek" <mva...@su...>
Cc: <ipc...@li...>
Sent: Saturday, June 21, 2003 10:52 PM
Subject: Re: [IPCop-devel] PPP settings problem


> on 18/6/03 1:01 pm, Marco van Beek at mva...@su...
wrote:
>
> > Hi All,
> >
> > I haven't seen this reported on the list, but I think there is a bug in
1.3
> > when saving the ppp profiles. It seems to save the settings file as
> > "setting-" without the number, and the profile list dropdown always
shows
> > empty profiles.
> >
> > As long as you only have one profile, it is fine, but if you set up a
second
> > profile, it overwrites the first.
> >
> > I think this may be to do with needing to select a profile before
saving, as
> > the file saving routine uses a variable, which probably isn't set if you
> > start on a blank page. I think the line I mean is indicated below. If
there
> > isn't a $pppsettings{'PROFILE'} variable set, it would be blank, causing
> > what I see when it saves the profile. The workaround isn't difficult,
but
> > may be we need some additional error checking here asking people to
select a
> > blank profile first, maybe?
> >
> > ===========================
> > if ($errormessage) {
> > $pppsettings{'VALID'} = 'no'; }
> > else {
> > $pppsettings{'VALID'} = 'yes'; }
> >
> > # write cgi vars to the file.
> >>>> &writehash("${swroot}/ppp/settings-$pppsettings{'PROFILE'}",
> > \%pppsettings);
> >
> > # make link and write secret file.
> > &updatesettings();
> > &writesecrets();
> >
> > &log("$tr{'profile saved'} $pppsettings{'PROFILENAME'}");
> > =============================
> >
> > Regards
> >
> > Marco van Beek
> > Supporting Role Ltd.
>
> Hi
>
> I can confirm this behaviour. Can I suggest adding this into the error
> checking when the action is 'save'?
>
>     if ( $pppsettings{'PROFILE'} eq '') {
>         $errormessage = $tr{'select a profile'};
>         goto ERROR; }
>
> and adding the translated phrase to en.pl (* required). You may want to
pick
> a better error message, such as "Select a profile before saving" or
"Select
> a profile first".
>
> Anybody else like to test and confirm this?
>
> Eric
>
> (* It won't appear as an error with a blank errormessage string).
>
>
I had seen the problem once but was not able to reproduce again and I didn't
know if the 'setting-' file come from V1.2 backup or V1.3.
The quickest way to see the problem is to erase one profile.
So none is selected even the first profile is displayed and if you save
before to select a profile, the bug is visible in var/ipcop/ppp
It's to late to check in the save part that no profile is selected because
you will loose everything you have typed in.

I think it would be better to avoid that no profil is selected. So I suggest
to change the erase part to keep the current profil selected and not
displaying the first profil name not really selected using a code similar to
the select part.

I have tested partialy my changes and it's look to work when deleting a
profile.
 &log("$tr{'profile deleted'} $pppsettings{'PROFILENAME'}");
 my $profile = $pppsettings{'PROFILE'};
 truncate ("${swroot}/ppp/settings-$pppsettings{'PROFILE'}", 0);
 %pppsettings = ();
 $pppsettings{'VALID'} = '';
 &readhash("${swroot}/ppp/settings", \%pppsettings);

 %temppppsettings = ();
 $temppppsettings{'PROFILE'} = '';
 &readhash("${swroot}/ppp/settings-$pppsettings{'PROFILE'}",
  \%temppppsettings);

 # make link.
 &updatesettings();

 %pppsettings = ();
 &readhash("${swroot}/ppp/settings", \%pppsettings);
 $pppsettings{'PROFILE'} = $profile;
 &writehash("${swroot}/ppp/settings-$pppsettings{'PROFILE'}",
  \%pppsettings);

Some part of this code may be not necessary. I need to test and understand
But the first time you install without backup, I think that also no profil
is selected and 'something' is to do

I can suggest also to move the profil name box near the save button to avoid
to type a profil name wich will be erased if using the refresh button to
select an interface.

on 18/6/03 1:01 pm, Marco van Beek at mva...@su... wrote:

> Hi All,
> 
> I haven't seen this reported on the list, but I think there is a bug in 1.3
> when saving the ppp profiles. It seems to save the settings file as
> "setting-" without the number, and the profile list dropdown always shows
> empty profiles.
> 
> As long as you only have one profile, it is fine, but if you set up a second
> profile, it overwrites the first.
> 
> I think this may be to do with needing to select a profile before saving, as
> the file saving routine uses a variable, which probably isn't set if you
> start on a blank page. I think the line I mean is indicated below. If there
> isn't a $pppsettings{'PROFILE'} variable set, it would be blank, causing
> what I see when it saves the profile. The workaround isn't difficult, but
> may be we need some additional error checking here asking people to select a
> blank profile first, maybe?
> 
> ===========================
> if ($errormessage) {
> $pppsettings{'VALID'} = 'no'; }
> else {
> $pppsettings{'VALID'} = 'yes'; }
> 
> # write cgi vars to the file.
>>>> &writehash("${swroot}/ppp/settings-$pppsettings{'PROFILE'}",
> \%pppsettings);
> 
> # make link and write secret file.
> &updatesettings();
> &writesecrets();
> 
> &log("$tr{'profile saved'} $pppsettings{'PROFILENAME'}");
> =============================
> 
> Regards
> 
> Marco van Beek
> Supporting Role Ltd.

Hi

I can confirm this behaviour. Can I suggest adding this into the error
checking when the action is 'save'?

    if ( $pppsettings{'PROFILE'} eq '') {
        $errormessage = $tr{'select a profile'};
        goto ERROR; }

and adding the translated phrase to en.pl (* required). You may want to pick
a better error message, such as "Select a profile before saving" or "Select
a profile first".

Anybody else like to test and confirm this?

Eric

(* It won't appear as an error with a blank errormessage string).