Differences

This shows you the differences between two versions of the page.

--- doc:appunti:linux:sa:nf_conntrack_expect [2025/01/10 15:05] – [Shorewall and helpers] niccolo
+++ doc:appunti:linux:sa:nf_conntrack_expect [2025/03/14 10:05] (current) – [Shorewall and helpers] niccolo
@@ Line 164: / Line 164: @@
 In this case the helper is instantiated into the raw table in both PREROUTING and OUTPUT chains.
-The default **Debian 12 Bookworm** configuration for Shorewall provides a **conntrack** file where helpers are enabled only if the Shorewall **AUTOHELPERS** option is enabled and if FIXME **CT_TARGET** :?:
+The default **Debian 12 Bookworm** configuration for Shorewall provides a **conntrack** file where helpers are enabled only if the Shorewall **AUTOHELPERS** option is enabled (in ''shorewall.conf'') and if the **CT_TARGET** iptables/netfilter capability is available (verify the output of ''shorewall show capabilities'').
+==== Shorewall upgrade from Debian 11 to 12 ====
+In Debian, upgrading to **Shorewall 5.2.8** as per upgrade from **Debian 11 Bullseye** to **Debian 12 Bookworm**, connection tracking protocol helpers are no longer globally enabled by default; use **shorewall-conntrack(5)** or **shorewall-rules(5)** to enable them as appropriate where they are required.
+Setting **AUTOHELPERS** to 'Yes' in shorewall.conf restores the previous behavior.
 ===== Web references =====