Hi, I'd appreciate some advice. We installed a new firewall in front of our old firewall, leaving openvpn and some other services running on the old firewall (We realize that running those on the same box was a bad idea). We uninstalled shorewall on the old firewall, but I still see some messages such as:

Mar 6 11:55:04 firewallb kernel: Shorewall:net2allROP:IN=eth0 OUT=br0 SRC=xx.x.xx.xxx
DST=xx.x.x.xxx LEN=105 TOS=0x00 PREC=0x00 TTL=127 ID=54740 PROTO=UDP SPT=1049 DPT=161 LEN=85

The service is not running, but a shorewall status results in a ton of info.

How can this be without the service running? Is something installed and running in the kernel? What do I do to totally remove shorewall?

First, what distro are you using?

Second, how did you "uninstall" shorewall?

Have you tried creating a new iptables script and saving it over the default firewall rules file? If you are using a Redhat/Fedora-like distro you can use 'service iptables save'. This will vary from distro to distro though.