ipcop-devel Mailing List for IPCop Firewall

Rafael

Have a look inside the /usr/lib/ipcop/ddns-lib.pl file, I think that's
where the Dns providers are defined.

http://ipcop.svn.sourceforge.net/viewvc/ipcop/ipcop/trunk/src/libs/ddns-lib.pl?revision=3310&view=markup

Regards

Eric

On Mon, Nov 30, 2009 at 06:30:56PM +0100, Rafael Reinoso wrote:
<snip> 
> Is MENUENTRY a command (not what I can see)? I don't get it (but I'm
> not a Linux guru either ). Is this the clue to how to add one more
> dynamic DNS service? Any ideas?
<snip>

It's used by the updatemenu.pl script:
    http://ipcop.svn.sourceforge.net/viewvc/ipcop/ipcop/trunk/src/scripts/updatemenu.pl?view=markup


-- 
#---------------------------------------------------------#
|    John Edwards   Email: jo...@co...    |
#---------------------------------------------------------#

>Från: Rafael Reinoso 
>Skickat: den 28 november 2009 23:54
>Till: 'ipc...@li...'
>Ämne: Howto add one more dynamic DNS service?...
>
>Hello!
>
>I have domains at a company named Loopia.se. They say that they have support for DynDNS.org like dynamic IP changes. Info (in Swedish) is found here:
https://support.loopia.se/wiki/DNS-klienter
>
>There they say that:
>1. If I use DynDNS Updater 3.1, I can use these settings in the ini file:
https://www.loopia.se/kdbfiler/LoopiaDNS.ini
>
>2. If I use DynSite, I can use this file:
>https://www.loopia.se/kdbfiler/loopiadns.dns
>
>3. If I use CURL, I can use this file:
>https://support.loopia.se/wiki/CURL
>
>4. If I use DDclient, I can use this file:
>https://support.loopia.se/wiki/DDclient_%28Linux_%26_UNIX%29
>and/or this file:
>https://www.loopia.se/kdbfiler/ddclient.conf
>
>I'm sure you guess where I'm going with this ;-)
>a) Is there anything against adding one more dynamic DNS service?
>b) How can I add one more dynamic DNS service? Change in one or many files?
>
>/Rafael
Hi again!

In the file /home/httpd/cgi-bin/ddns.cgi (2.0 beta) I found this:
[START]
# Add entry in menu
# MENUENTRY services 030 "dynamic dns" "dynamic dns client"
#
# Make sure translation exists $Lang::tr{'dynamic dns client'}
[END]

What do this mean? 
MENUENTRY services 030 "dynamic dns" "dynamic dns client"

Is MENUENTRY a command (not what I can see)? I don't get it (but I'm not a Linux guru either  ). Is this the clue to how to add one more dynamic DNS service? Any ideas?

And in the same file also:
[START]
# Files used
my $setting = '/var/ipcop/ddns/settings';
our $datafile = '/var/ipcop/ddns/config';
my $logDirName = '/var/log/dyndns';
[END]

The settings file has this:
[START]
BEHINDROUTER=FETCH_IP
MINIMIZEUPDATES=
[END]

And the config file has this:
[START]
dyndns.org,foo,mydomain.com,,,password,username,on
[END]

And the log files contains the external IP numbers that are used.

Hello!

I have domains at a company named Loopia.se. They say that they have
support for DynDNS.org like dynamic IP changes. Info (in Swedish) is
found here:
https://support.loopia.se/wiki/DNS-klienter

There they say that:
1. If I use DynDNS Updater 3.1, I can use these settings in the ini
file:
https://www.loopia.se/kdbfiler/LoopiaDNS.ini

2. If I use DynSite, I can use this file:
https://www.loopia.se/kdbfiler/loopiadns.dns

3. If I use CURL, I can use this file:
https://support.loopia.se/wiki/CURL

4. If I use DDclient, I can use this file:
https://support.loopia.se/wiki/DDclient_%28Linux_%26_UNIX%29
and/or this file:
https://www.loopia.se/kdbfiler/ddclient.conf

I'm sure you guess where I'm going with this ;-)
a) Is there anything against adding one more dynamic DNS service?
b) How can I add one more dynamic DNS service? Change in one or many
files?

/Rafael

Guenter wrote:

> - DHCP is somehow broken. We saw some other posts here already in the
> last weeks where others also reported probs with DHCP (mainly on BLUE),
> and I can confirm that there are issues:

I think it was me that reported problems with DHCP on Blue when attempting 
to connect to an Linux Asus EEEPC. 

It turned out to be an incompatibility between the installed WiFi card and 
the linux drivers in the EEEPC. Since I replaced the WiFi card with a 
compatible  Intel WM3945AG in the EEEPC, wireless and DHCP have worked 
without problem for about the last 3 weeks with IPCop 1.9.7.

Bob



  

Gilles,
Gilles Espinasse schrieb:
> Looking at src/installer/partition.c where the big sed is made, KVER
> replacement only condition is if defined (__i386__).
> Maybe a sync could help to have the file really written on the device?
> That could be better than sleep(1)
> 
> If that fail, we should add some log messages checking if
> mysystem(bigstring) fail or is a success.
I believe what you found there might indeed be the prob; I did now an
installation via PXE on a VmWare VM, and that worked fine, so PXE does
also work; another installation from CD on a P3 box with an IDE flash
module worked too; so it seems really a special problem on slower boxes
perhaps; but again: 1.9.7 worked fine (installed 3 times successfully on
different Alix systems).

Gün.

Hi Olaf,
Olaf Westrik schrieb:
> I have just started uploading the remaining USB installation files for
> testing IPCop v1.9.9 on x86 machines. The CD and PXE installation files
> should already be online.
> http://sourceforge.net/projects/ipcop/files/IPCop%20Test%20Versions/IPCop%201.9.9
some more test results:
- Ipsec with certs is still not working for me, neither against another
1.9.9, nor against 1.4.21. PSK works fine though.
- I still see the Alix box suddenly start to write firewall logs to the
serial console; that looks as if file descriptors are mixed up (I posted
this problem already before for 1.9.8). Once this happens the box is not
anymore usable - means Internet access from remote client stops working,
also ssh login doesnt work anymore (although I get still the login
prompt), web interface doesnt work anymore, and after I logged in
through the serial line the reboot command get hung after the usual two
init messages, and the box did not shutdown even after 5 mins.
- DHCP is somehow broken. We saw some other posts here already in the
last weeks where others also reported probs with DHCP (mainly on BLUE),
and I can confirm that there are issues:
--- fixed leases do not work directly after taken over from dynamic
list; I checked /var/ipcop/dhcp and found everything was correctly
stored in fixedleases, but the old entry in
/var/run/dnsmasq/dnsmasq.leases was not deleted, thus another DHCP
request gave me again the old dynamic IP instead of the newly entered
fixed one. Also even after I deleted the dynamic entry from
dnsmasq.leases *and* stop/start dnsmasq the old dynamic lease was still
offered instead of the new one. I tested this a couple of times with a
VmWare VM via PXE request and with a real machine with RTL8039 via PXE
request.

Gün.

Eric,
here few things for start (feel free to change to better wording) ...

Eric Oberlander schrieb:
> Anybody running IPsec on the new version of IPCop, who would care to
> comment on the new Admin Manual?
> http://www.ipcop.org/2.0.0/en/admin/html/vpns-ipsec.html
- Delay before launching VPN (seconds).  Content to be written...
+ Delay before launching VPN (seconds).  If you have a fixed public IP 
on RED then you should keep the value of 0. If you are using a dynamic 
DNS service, you should use a minimum value of 60 secs so that the 
dynamic DNS entry gets some time to be properly propagated to all DNS 
servers.

> I wondered if the Authentication section is still valid, as
yes.
> Certificate Generation has been moved to another webpage?
what do you mean here? Only CA generation is moved to a separate webpage 
in order to have one central CA for both Ipsec and OpenVPN; with 1.4.x 
we dont have OpenVPN build-in but only as Zerina AddOn, therefore we had 
always 2 separate CAs, each on its own page.

Gün.

2009/11/25 Guenter <li...@gk...>:
> Eric,
> here few things for start (feel free to change to better wording) ...
>
> Eric Oberlander schrieb:
>>
>> Anybody running IPsec on the new version of IPCop, who would care to
>> comment on the new Admin Manual?
>> http://www.ipcop.org/2.0.0/en/admin/html/vpns-ipsec.html
>
> - Delay before launching VPN (seconds).  Content to be written...
> + Delay before launching VPN (seconds).  If you have a fixed public IP on
> RED then you should keep the value of 0. If you are using a dynamic DNS
> service, you should use a minimum value of 60 secs so that the dynamic DNS
> entry gets some time to be properly propagated to all DNS servers.
>
>> I wondered if the Authentication section is still valid, as
>
> yes.
>>
>> Certificate Generation has been moved to another webpage?
>
> what do you mean here? Only CA generation is moved to a separate webpage in
> order to have one central CA for both Ipsec and OpenVPN; with 1.4.x we dont
> have OpenVPN build-in but only as Zerina AddOn, therefore we had always 2
> separate CAs, each on its own page.
>
> Gün.

Ok, thanks for clarifying that.

Eric

Hi

Anybody running IPsec on the new version of IPCop, who would care to
comment on the new Admin Manual?
http://www.ipcop.org/2.0.0/en/admin/html/vpns-ipsec.html

I wondered if the Authentication section is still valid, as
Certificate Generation has been moved to another webpage?

Any suggestions for improvements to the text, or links to Howtos
gratefully received.

Thanks

Eric

Hi,
Gilles Espinasse schrieb:
>> Olaf Westrik schrieb:
>>> Works here (same as before).
>>> Several days ago I (repeatedly) installed via serial console without any
>>> problems.
>>>
>>> There is one big sed that replaces everything in extlinux.conf.
>>> Something must be different on your box, probably hardware or some other
>>> combination.
>> well, its an Alix board, and it worked fine with 1.9.7; starting with
>> 1.9.8 this prob showed first up; so it must definitely be a prob with
>> the installer. Remember that I use PXE, and since Alix is an embedded
>> system there's nothing I could have changed with the hardware, also used
>> same CF card.
>>
> Looking at src/installer/partition.c where the big sed is made, KVER
> replacement only condition is if defined (__i386__).
> Maybe a sync could help to have the file really written on the device?
> That could be better than sleep(1)
> 
> If that fail, we should add some log messages checking if
> mysystem(bigstring) fail or is a success.
I think it would be *very* helpful if we could create a PXE-boot image
with a full-blown busybox (ftpget, ftpput, patch, diff, vi, etc) and
dhcpc script directly from sources (optional) which boots to an ash
prompt; with that it would be very easy to fix such problems as what I
currently see (and in fact I fixed it this way with a modified 1.4.20
PXE image).
I've though no idea how much it would take to add such to the build
stuff ... - what do you think?

Gün.

----- Original Message ----- 
From: "Guenter" <li...@gk...>
To: "Olaf Westrik" <wei...@ip...>
Cc: "IPCop devel" <ipc...@li...>
Sent: Monday, November 23, 2009 5:01 PM
Subject: Re: [IPCop-devel] [2.0] release of v1.9.9, SVN #3842


> Olaf Westrik schrieb:
>> Works here (same as before).
>> Several days ago I (repeatedly) installed via serial console without any
>> problems.
>>
>> There is one big sed that replaces everything in extlinux.conf.
>> Something must be different on your box, probably hardware or some other
>> combination.
> well, its an Alix board, and it worked fine with 1.9.7; starting with
> 1.9.8 this prob showed first up; so it must definitely be a prob with
> the installer. Remember that I use PXE, and since Alix is an embedded
> system there's nothing I could have changed with the hardware, also used
> same CF card.
>
Looking at src/installer/partition.c where the big sed is made, KVER
replacement only condition is if defined (__i386__).
Maybe a sync could help to have the file really written on the device?
That could be better than sleep(1)

If that fail, we should add some log messages checking if
mysystem(bigstring) fail or is a success.

Gilles

Olaf Westrik schrieb:
> Works here (same as before).
> Several days ago I (repeatedly) installed via serial console without any
> problems.
> 
> There is one big sed that replaces everything in extlinux.conf.
> Something must be different on your box, probably hardware or some other
> combination.
well, its an Alix board, and it worked fine with 1.9.7; starting with 
1.9.8 this prob showed first up; so it must definitely be a prob with 
the installer. Remember that I use PXE, and since Alix is an embedded 
system there's nothing I could have changed with the hardware, also used 
same CF card.

Gün.

Guenter wrote:
> Hi Olaf,
> Olaf Westrik schrieb:
>> I have just started uploading the remaining USB installation files for
>> testing IPCop v1.9.9 on x86 machines. The CD and PXE installation files
>> should already be online.
>> http://sourceforge.net/projects/ipcop/files/IPCop%20Test%20Versions/IPCop%201.9.9
>>
>>
>> There are not so many changes this time, but you'll find some
>> interesting ones nonetheless.
> unfortunately serial flash installation is still not fixed:

Works here (same as before).
Several days ago I (repeatedly) installed via serial console without any
problems.


> EXTLINUX 3.83 2009-10-05 CBIOS Copyright (C) 1994-2009 H. Peter Anvin et al
> Missing parameter in configuration file. Keyword: SERIAL_CONSOLE
> 
> means vars in extlinux.conf are still not expanded - see attached file.

There is one big sed that replaces everything in extlinux.conf.
Something must be different on your box, probably hardware or some other
combination.


Olaf

Hi Olaf,
Olaf Westrik schrieb:
> I have just started uploading the remaining USB installation files for
> testing IPCop v1.9.9 on x86 machines. The CD and PXE installation files
> should already be online.
> http://sourceforge.net/projects/ipcop/files/IPCop%20Test%20Versions/IPCop%201.9.9
> 
> There are not so many changes this time, but you'll find some
> interesting ones nonetheless.
unfortunately serial flash installation is still not fixed:
EXTLINUX 3.83 2009-10-05 CBIOS Copyright (C) 1994-2009 H. Peter Anvin et al
Missing parameter in configuration file. Keyword: SERIAL_CONSOLE

means vars in extlinux.conf are still not expanded - see attached file.

Gün.

Hi!

Everything works fine. The problem was with CD Drive.
I used external USB ASUS DRW-1608P2S-D first. 
Now - multy IDE/SATA to USB adapter ("AGE Star")


> I'm made photo my installation:
>
> ftp://ftp.beta.ru/public/ipcop/1.jpg - con.1
> ftp://ftp.beta.ru/public/ipcop/2.jpg - con.2
> ftp://ftp.beta.ru/public/ipcop/3.jpg - con.3
> ftp://ftp.beta.ru/public/ipcop/4.jpg - con.4
> ftp://ftp.beta.ru/public/ipcop/5.jpg - con.5
>
> ipCOP v1.9.8
> CF size 2 and 4Gb Transcend (x133)
> MB: Intel D945GCLF2
> CPU: Atom 330 (1,6x2)
> IDE-CF Adapter: Espada ADIDE2CF-A2
> RAM: 1Gb
>
> I entered on console 5 the last command of instalation:
> tar -C /harddisk -vxpzf /cdrom/ipcop-1.9.8.tar.gz
> At the end of the output:
> [..]
> ./bin/rm
> ./bin/hostname
> ./bin/cpio
> tar: short read
>
>
> P.S. v1.4.21 the CF works great!
>
> ----- Original Message ----- 
> Sent: Monday, October 26, 2009 11:59 PM
>
>
>>> Could you test on console 5 with hdparm /dev/hda to see what is 
>>> reported.
> hdparm: not found
>
>>> You could too test with dd if=/dev/zero of=/dev/hda bs=1M count=5
> 5+0 ...... in
> 5+0 ...... out
> (I am at home. I don't remember exactly what was written)
>
> On console 1:
> tar error
> <OK>
>
> On console 2:
> [...]
> ....tar ..... /harddisk .........
>
> On console 3:
> [...]
> tar: read short

________________________________________________________
Bye. 

Olaf Westrik wrote:

> Bob wrote:
> 
>> # MENUENTRY status 100 "adsl" "ADSL Graphs" "?graph=adsl"
>> 
>> and can invoke the script with:
>> https://x.x.x.x:8443/cgi-bin/adslgraphs.cgi/?graph=adsl
>> which displays my adsl graphs but the top menu which I would expect to
>> show "Status >> ADSL Graphs" is blank.
> 
> Apply the modification from SVN r3857 to updatemenu.pl
> That should work better.
>
This did not solve the problem although I do now have a solution.
 
> The use of graphs.cgi would have also been hit by that, but there is
> some special code in header.pl for the standard graphs, so it did not
> show there.
> 
I can now see why my script did not perform in a similar way to graphs.cgi 
and have modified my script to accept a null as the default and therefore 
removed the "?graph=adsl" from my MENUENTRY. The menu now displays the 
correct information.

Thank you for the help.

Bob

Eric Oberlander wrote:

> For the short term, I have described the steps needed to get the
> Speedtouch 330 USB ADSL modem working in the v2 Admin Manual, at:
> http://www.ipcop.org/2.0.0/en/admin/html/network-upload.html

Cool. Thanks.
Now all we need is a link to the online manual on the GUI page ;-)

Maybe a good idea to slightly rearrange the sections like this:

text

Modem rev:
Driver: present/not-present

file browse and upload button, with manual link in the right corner


> Is a reboot required?

I am not sure, but I think it would suffice to unplug / plug the USB modem.


Olaf

>>> Why not describe the needed (console) steps in a manual appendix?
>>>
>> We should run firmware-extractor from a helper that the GUI could run.
>> This way, we could procede to firmware extraction in a temporary directory.
>> If there is no error on firmware extraction, that should be safe to copy
>> produced files in /lib/firmware. There is no need to exec right, and
>> firmware is only run by the modem cpu.
>> We could have a size check limit for produced files as that should be
>> trivial to produce a dummy very big file that include the start and stop
>> marks and fool firmware extractor during firmware spliting.
>
> Sound like (a lot of) work to me to inform the user in GUI usable form,
> especially if something does go wrong.

For the short term, I have described the steps needed to get the
Speedtouch 330 USB ADSL modem working in the v2 Admin Manual, at:
http://www.ipcop.org/2.0.0/en/admin/html/network-upload.html

Is a reboot required?

Eric

Bob wrote:

> # MENUENTRY status 100 "adsl" "ADSL Graphs" "?graph=adsl" 
> 
> and can invoke the script with:
> https://x.x.x.x:8443/cgi-bin/adslgraphs.cgi/?graph=adsl
> which displays my adsl graphs but the top menu which I would expect to show 
> "Status >> ADSL Graphs" is blank.

Apply the modification from SVN r3857 to updatemenu.pl
That should work better.

The use of graphs.cgi would have also been hit by that, but there is
some special code in header.pl for the standard graphs, so it did not
show there.


Olaf

Hi

I have an addon that monitors my ADSL performance which invokes a cgi script 
to display my ADSL performance graphs and I am modifying it to run on 
v1.9.7. In the headers of this script I have:

# MENUENTRY status 100 "adsl" "ADSL Graphs" "?graph=adsl" 

and can invoke the script with:
https://x.x.x.x:8443/cgi-bin/adslgraphs.cgi/?graph=adsl
which displays my adsl graphs but the top menu which I would expect to show 
"Status >> ADSL Graphs" is blank.

If I invoke the script without the "?graph=adsl" in MENUENTRY the top menu 
is displayed as expected but I obviously can't see my data.

I presume that I am not using MENUENTRY correctly but have been unable to 
find any documentation on its syntax so I would really appreciate a few 
pointers on its correct use.

Thanks

Bob 

Dear all,


I have just started uploading the remaining USB installation files for
testing IPCop v1.9.9 on x86 machines. The CD and PXE installation files
should already be online.
http://sourceforge.net/projects/ipcop/files/IPCop%20Test%20Versions/IPCop%201.9.9

There are not so many changes this time, but you'll find some
interesting ones nonetheless.



IPCop 1.9.9 is released


v1.9.9 is a BETA version, *DO NOT* use in a productive environment.

Some things will work, for example cleaning your harddisk on installation.
Some things may work.
Some things will not work.

There may be updates to later versions, but it is very likely that a full
installation is required to use newer versions.
There will be no support.


If you want to help, you can do so by testing and reporting any issues
you should find. Reports should go to the ipcop-devel mailing list.
Make sure that reports are verbose! also specify the exact version you
have been testing, either 1.9.9 or SVN version number if you are building
IPCop by yourself.
A simple "xyz does not work" will get you nowhere! and is more than likely
to be ignored.


For those familiar with earlier IPCop versions, IPCop v2 is different.

Noteworthy:
- the GUI uses 8443 instead of 445
- SSH uses 8022 instead of 222
- access to IPCop and to the internet from internal networks (aka
Green, Blue, Orange) is very much different. Spend some time with the
various options you will find under "Firewall Settings" and the online
admin manual.
- translations are incomplete
- (online) manual is still incomplete but large sections are available
and worth reading.


v1.9.9 is a BETA version, *DO NOT* use in a productive environment.



http://sourceforge.net/projects/ipcop/files/IPCop%20Test%20Versions/IPCop%201.9.9

MD5sum
ba2633ebab9d26bb14e60cc751afb5f8  ipcop-1.9.9-install-cd.i486.iso
0617c3b0cc8055b995f468ac5c20f425  ipcop-1.9.9-install-netboot.i486.tgz
9cf835308925d00f7057d1d2b677c4c2  ipcop-1.9.9-install-usb-fdd.i486.img.gz
457d8e5bc165637bf15ade8b4b4c8372  ipcop-1.9.9-install-usb-hdd.i486.img.gz
ee1ef3ff5bb0970e1ff95232132128a9  ipcop-1.9.9-install-usb-zip.i486.img.gz
06ea1fc908f74f12dd70dc3411f1b54d  ipcop-1.9.9-install-avmdrv.i486.tgz

Olaf,
Guenter schrieb:
> Hi Olaf,
> Olaf Westrik schrieb:
>> Anyways I found one report with a possible solution:
>> http://forums.debian.net/viewtopic.php?f=10&t=45797#p261964
>> That could be a starting point.
> indeed this looks promissing! If that works I'll report back, and
> suggest that we ship such an /etc/e2fsck.conf file with Ipcop.
that seems to work!
-------------------------------------------------------------
root has filesystem last checked time in the future, check forced.
root: ***** REBOOT LINUX *****
root: 7116/120720 files (0.0% non-contiguous), 43807/481942 blocks
Checking filesystems integrity: Passed, but reboot is required
WARNING:

File system errors were found and have been corrected, but the nature of 
the errors require this system to be rebooted.

After you press enter, this system will be rebooted
-------------------------------------------------------------
after reboot the other partions were fixed and system started ... :)
perhaps you may also find something to set the reboot timer to 0; 
currently its 10 secs until automatic reboot happens ...

Gün.

Darren Critchley wrote:
> Not sure if anyone noticed this and if it will affect anything, This is 
> the 1.9x latest CVS I am running.
> 
> 
> Nov 17 09:05:22 ipcop kernel: nf_conntrack version 0.5.0 (8192 buckets, 
> 32768 max)
> Nov 17 09:05:22 ipcop kernel: CONFIG_NF_CT_ACCT is deprecated and will 
> be removed soon. Plase use
> Nov 17 09:05:22 ipcop kernel: nf_conntrack.acct=1 kernel paramater, 
> acct=1 nf_conntrack module option or
> Nov 17 09:05:22 ipcop kernel: sysctl net.netfilter.nf_conntrack_acct=1 
> to enable it.
> ----------------------------------------------------------------------
> 
> Has this already been taken care of? I am not a kernel expert, so was 
> curious about this warning message.


I did notice that a long time ago, but forgotten about it.


Anyways here is some background information:
http://marc.info/?l=netfilter-devel&m=123722242218166&w=2


Also it does not appear to be possible to get rid of that message, the
kernel parameter is ignored (unknown):

19:37:01	kernel	Kernel command line: mode=normal
initrd=ipcoprd-2.6.27-2.img root=/dev/disk/by-label/root ro panic=10
quiet nf_conntrack.acct=1 BOOT_IMAGE=vmlinuz-2.6.27-2
19:37:01	kernel	Unknown boot option `nf_conntrack.acct=1': ignoring

adding to /etc/sysctl.conf does not stop the message and
modprobe nf_conntrack acct=1 still throws the same message.

cat /proc/sys/net/netfilter/nf_conntrack_acct does show 1 though...


Ah well, it is an imperfect world.


Olaf

Not sure if anyone noticed this and if it will affect anything, This is 
the 1.9x latest CVS I am running.


Nov 17 09:05:22 ipcop kernel: nf_conntrack version 0.5.0 (8192 buckets, 
32768 max)
Nov 17 09:05:22 ipcop kernel: CONFIG_NF_CT_ACCT is deprecated and will 
be removed soon. Plase use
Nov 17 09:05:22 ipcop kernel: nf_conntrack.acct=1 kernel paramater, 
acct=1 nf_conntrack module option or
Nov 17 09:05:22 ipcop kernel: sysctl net.netfilter.nf_conntrack_acct=1 
to enable it.
----------------------------------------------------------------------

Has this already been taken care of? I am not a kernel expert, so was 
curious about this warning message.

Darren