Re: [Shorewall-users] Shorewall not starting

[Philip Le Riche via Shorewall-users]

Many thanks Justin - systemctl enable shorewall fixed it. Nice to have 
such a simple solution!


Thanks also Matt. At a glance I might be able to use [1] to get sshd and 
apache2 to start, but that's for tomorrow.
(Yes, should have been /var/log/shorewall-init.log. Nothing added on 
booting until shorewall started manually, until which shorewall status 
said stopped.)


On 29/07/2023 19:18, Justin Pryzby wrote:

On Sat, Jul 29, 2023 at 02:25:05PM +0100, Philip Le Riche via Shorewall-users 
wrote:

As before, this is running under Linux Mint (Ubuntu-based), and this time I
installed Shorewall from the standard repository for the distro (perhaps
that was my mistake?) It's failing to start on boot even though I have
STARTUP_ENABLED=Yes in my shorewall.conf.

You should determine if shorewall is *trying* to start and failing, or
if systemd is not configured to start it.

$ sudo systemctl status shorewall
Loaded: loaded (/lib/systemd/system/shorewall.service; enabled; vendor preset: 
enabled)


Also, I was surprised to find that /etc/systemd/system/shorewall.service
didn't exist.

Maybe you need to run:
systemctl enable shorewall

https://shorewall.org/FAQ.htm#idm1200





___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting

[Justin Pryzby]

On Sat, Jul 29, 2023 at 02:25:05PM +0100, Philip Le Riche via Shorewall-users 
wrote:
> As before, this is running under Linux Mint (Ubuntu-based), and this time I
> installed Shorewall from the standard repository for the distro (perhaps
> that was my mistake?) It's failing to start on boot even though I have
> STARTUP_ENABLED=Yes in my shorewall.conf.

You should determine if shorewall is *trying* to start and failing, or
if systemd is not configured to start it.

$ sudo systemctl status shorewall
Loaded: loaded (/lib/systemd/system/shorewall.service; enabled; vendor preset: 
enabled)

> Also, I was surprised to find that /etc/systemd/system/shorewall.service
> didn't exist.

Maybe you need to run:
systemctl enable shorewall

https://shorewall.org/FAQ.htm#idm1200

-- 
Justin


___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting

[Matt Darfeuille]

On 7/29/23 15:25, Philip Le Riche via Shorewall-users wrote:
As before, this is running under Linux Mint (Ubuntu-based), and this 
time I installed Shorewall from the standard repository for the distro 
(perhaps that was my mistake?) It's failing to start on boot even though 
I have STARTUP_ENABLED=Yes in my shorewall.conf.




What output do you get if you do 'systemctl status shorewall'?

I thought it was related to the fact that sshd and apache2 are also 
failing to start. This is because not all interfaces aren't up by the 
time their startup scripts run. This, in turn, seems to be because the 
16 IP address aliases on the school net NIC (NATted to local IPs of the 
Raspberry Pis) are apparently taking around 25 seconds to initialise. 
(Originally, I set these up manually but I'm now letting Shorewall do it 
by setting ADD_IP_ALIASES=Yes, now Shorewall is taking 25 seconds to 
start.)


However, I now think that's a separate problem (perhaps I could add 
/usr/share/shorewall/wait4ifup to their startup scripts) since nothing 
appears in /var/log/shorewall.init until I manually start Shorewall.




Is 'shorewall.init' a typo?

Also, I was surprised to find that /etc/systemd/system/shorewall.service 
didn't exist.


Are there any more diagnostics or fixes I can try before I try 
uninstalling shorewall as installed from the repository and reinstalling 
it using the tarball from shorewall.net? And should I include 
shorewall-init? (The network switch to which the Pis re connected might 
be switched off at the time the firewall is booted.)




You could try [1] to see if it could help you solve the race condition 
issue.


Using 'optional'[2]  might also help.

I would first try to get Shorewall going before adding shorewall-init 
into the mix!



[1] 
https://www.freedesktop.org/software/systemd/man/systemd-networkd-wait-online.service.html

[2]  https://shorewall.org/manpages/shorewall-interfaces.html

--
Matt Darfeuille 
Community: https://sourceforge.net/p/shorewall/mailman/message/37107049/
SPC: https://sourceforge.net/p/shorewall/mailman/message/36596609/
Homepage: https://shorewall.org



___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting

[Philip Le Riche]

Finally got around to checking this out.

systemctl is-enabled reported enabled for shorewall but not for
shorewall-init. So I enabled it for shorewall-init, and when it still
didn't start on boot I reenabled both, but still with no improvement.
There's no sign (that I can see) of it failing on boot - it just doesn't
seem to run.

So I'm at a loss as to why shorewall still doesn't start. The only other
thing I found is that the SMART data on the system disk (an SSD) is
showing a high rate of ecc errors. This could be causing some disk reads
to take a lot longer than others. Timing shouldn't have any effect on a
well written initialisation script, though I'm aware that creating a
"well written script" is easier said than done.

I'll append the output from a manual shorewall start.

Regards - Philip

PiWall ~ # shorewall start
Compiling using Shorewall 5.0.4...
Processing /etc/shorewall/params ...
Processing /etc/shorewall/shorewall.conf...
Loading Modules...
Compiling /etc/shorewall/zones...
Compiling /etc/shorewall/interfaces...
   Interface "schl eno1 tcpflags,nosmurfs,logmartians,sourceroute=0"
Validated
   Interface "pinet enp2s0 tcpflags,nosmurfs,routefilter,logmartians"
Validated
   Interface "inet ppp0
tcpflags,nosmurfs,logmartians,sourceroute=0,optional" Validated
Determining Hosts in Zones...
   fw (firewall)
   schl (ipv4)
  eno1:0.0.0.0/0
   pinet (ipv4)
  enp2s0:0.0.0.0/0
   inet (ipv4)
  ppp0:0.0.0.0/0
Locating Action Files...
Compiling /etc/shorewall/policy...
   Policy for pinet to schl is DROP using chain pinet-schl
   Policy for pinet to inet is DROP using chain pinet-inet
   Policy for schl to fw is DROP using chain schl-all
   Policy for schl to pinet is DROP using chain schl-all
   Policy for schl to inet is DROP using chain schl-all
   Policy for inet to fw is DROP using chain inet-all
   Policy for inet to schl is DROP using chain inet-all
   Policy for inet to pinet is DROP using chain inet-all
   Policy for fw to schl is REJECT using chain all-all
   Policy for fw to pinet is REJECT using chain all-all
   Policy for fw to inet is REJECT using chain all-all
   Policy for schl to fw is REJECT using chain all-all
   Policy for schl to pinet is REJECT using chain all-all
   Policy for schl to inet is REJECT using chain all-all
   Policy for pinet to fw is REJECT using chain all-all
   Policy for pinet to schl is REJECT using chain all-all
   Policy for pinet to inet is REJECT using chain all-all
   Policy for inet to fw is REJECT using chain all-all
   Policy for inet to schl is REJECT using chain all-all
   Policy for inet to pinet is REJECT using chain all-all
Adding Anti-smurf Rules
Compiling TCP Flags filtering...
Compiling Kernel Route Filtering...
Compiling Martian Logging...
Compiling Accept Source Routing...
Compiling /etc/shorewall/providers...
Provider "raw 1 1 - ppp0 - fallback" Compiled
Provider "school 2 - - eno1 172.16.135.254 primary" Compiled
Compiling /etc/shorewall/rtrules...
Routing rule "enp2s0 - raw 11000 1" Compiled
Routing rule "lo - raw 11000 1" Compiled
Compiling /etc/shorewall/mangle...
   Mangle Rule "MARK(1) enp2s0 - udp 33434:33523 - - -" 0
   Mangle Rule "MARK(1) enp2s0 - 253 - - - -" 0
   Mangle Rule "MARK(1) fw - udp 33434:33523 - - -" 0
   Mangle Rule "MARK(1) fw - 253 - - - -" 0
Compiling /etc/shorewall/masq...
Masq record "eno1 192.168.1.0/24 172.16.135.160" 0
Masq record "ppp0 192.168.1.0/24 detect" 0
Compiling MAC Filtration -- Phase 1...
   Chain eno1_iop deleted
   Chain eno1_fop deleted
   Chain enp2s0_iop deleted
   Chain enp2s0_fop deleted
   Chain ppp0_iop deleted
   Chain ppp0_fop deleted
Compiling /etc/shorewall/rules...
..Expanding Macro /usr/share/shorewall/macro.Web...
Rule "PARAM - - tcp 80" 0
Rule "PARAM - - tcp 443" 0
..End Macro /usr/share/shorewall/macro.Web
Rule "Web(ACCEPT) pinet schl" 0
Rule "ACCEPT pinet schl udp ntp" 0
Rule "DNAT pinet schl:172.16.133.248 udp 53 - 192.168.1.254" 0
Rule "DNAT pinet schl:172.16.133.248 tcp 53 - 192.168.1.254" 0
..Expanding Macro /usr/share/shorewall/macro.SMBBI...
Rule "PARAM - - udp 135,445" 0
Rule " PARAM - - udp 137:139" 0
Rule "PARAM - - udp 1024: 137" 0
Rule "PARAM - - tcp 135,139,445" 0
Rule "PARAM DEST SOURCE udp 135,445" 0
Rule " PARAM DEST SOURCE udp 137:139" 0
Rule "PARAM DEST SOURCE udp 1024: 137" 0
Rule "PARAM DEST SOURCE tcp 135,139,445" 0
..End Macro /usr/share/shorewall/macro.SMBBI
Rule "SMBBI(ACCEPT) pinet fw" 0
..Expanding Macro /usr/share/shorewall/macro.Ping...
Rule "PARAM - - icmp 8" 0
..End Macro /usr/share/shorewall/macro.Ping
Rule "Ping(ACCEPT) pinet fw" 0
Rule "ACCEPT pinet inet udp 33434:33523" 0
Rule "ACCEPT pinet inet 253" 0
..Expanding Macro /etc/shorewall/macro.Pi...
Rule "PARAM - - tcp 5900:5909 - -" 0
Rule "PARAM - - tcp ssh - -" 0
Rule "PARAM - - tcp http - -" 0
Rule "PARAM - - tcp 8080:8081 - -" 0
..End Macro /etc/shorewall/macro.Pi
Rule

Re: [Shorewall-users] Shorewall not starting

[Philip Le Riche]

Thanks Matt and Roberto - I'll try the systemctl commands next time I go
into school (not until next week now). And it looks like I somehow
didn't install shorewall-init at home - not sure why.

Regards - Philip

On 25/01/2017 17:30, Matt Darfeuille wrote:
> On 1/25/2017 6:06 PM, Philip Le Riche wrote:
>> I've checked that STARTUP_ENABLED=Yes is still in my shorewall.conf, and
>> though I'm not familiar with systemd, I've checked that
>> shorewall.service in /lib/systemd/system is the same between home and
>> school setups. However, at school I also seem to have a
>> shorewall-init.service, not present at home (where Shorewall starts as
>> it should).
> See for shorewall-init.service:
> http://shorewall.org/Shorewall-init.html
> http://shorewall.org/manpages/shorewall-init.html
>
> -Matt


--
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting

[Matt Darfeuille]

On 1/25/2017 6:06 PM, Philip Le Riche wrote:
> 
> I've checked that STARTUP_ENABLED=Yes is still in my shorewall.conf, and
> though I'm not familiar with systemd, I've checked that
> shorewall.service in /lib/systemd/system is the same between home and
> school setups. However, at school I also seem to have a
> shorewall-init.service, not present at home (where Shorewall starts as
> it should).

See for shorewall-init.service:
http://shorewall.org/Shorewall-init.html
http://shorewall.org/manpages/shorewall-init.html

-Matt
-- 
Matt Darfeuille

--
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting

[Roberto C . Sánchez]

On Wed, Jan 25, 2017 at 05:06:38PM +, Philip Le Riche wrote:
> I got my Shorewall installation (defending a school network from  a
> Raspberry Pi farm, with 3rd unfiltered Internet connection) working  at
> home on an equivalent network though with different network addresses,
> and transferred the config files to school. After correcting a couple of
> really stoopid misteaks in resetting network and host addresses to
> school values it sort of works, but for some reason, Shorewall no longer
> starts on boot.
> 
> After boot, shorewall status says it's stopped, and gives the time it
> was last started, prior to the most recent reboot. No clues in
> /var/log/messages.
> 
> I've checked that STARTUP_ENABLED=Yes is still in my shorewall.conf, and
> though I'm not familiar with systemd, I've checked that
> shorewall.service in /lib/systemd/system is the same between home and
> school setups. However, at school I also seem to have a
> shorewall-init.service, not present at home (where Shorewall starts as
> it should).
> 

What is the output of these commands?

systemctl is-enabled shorewall
systemctl is-enabled shorewall-init

Regards,

-Roberto

-- 
Roberto C. Sánchez
http://people.connexer.com/~roberto
http://www.connexer.com


signature.asc
Description: Digital signature
--
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting

[Philip Le Riche]

I've just popped in to the school and the systemctl enable shorewall did
the trick.

Three or four reboots later I thought I'd seen the last of the desktop
crash, but then I was sorting out another problem - I have 16 DNAT rules
but had only added 8 extra IP addresses to the source NIC. After adding
the remaining 8 I rebooted and the desktop crashed. I was going to do a
shorewall dump as suggested but this crazy fallback desktop, would you
believe, doesn't provide a terminal! The usual ctl-alt-t didn't produce
one either. After rebooting it was fine and I'll probably never see it
again so it's not an issue for me. Probably I should have done a
shorewall reload before rebooting. If you can see theoretically why what
I did caused it to get into a strange state and can make it more robust,
then well and good.

I now just have one other unrelated problem and I'll start another
threadif I can't see how to fix it.

Thanks for your help and patience - regards - Philip

On 15/09/2016 13:33, Roberto C. Sánchez wrote:
> On Thu, Sep 15, 2016 at 09:18:26AM +0100, Philip Le Riche wrote:
>>OK, thanks, so on this near-clone system, systemd is installed and
>>systemctl shows  shorewall as disabled. When next I can get to the live
>>system (probably next week) I'll repeat it there, and it sounds like it
>>should then start on boot.
>>
> I hope that fixes the start-on-boot problem for you.
>
>>But does that explain why the desktop crashed when I enabled start-on-boot
>>through shorewall.conf and /etc/defaults/shorewall? Does the desktop need
>>an ACCEPT $fw $fw rule to talk to its (local) display server, or is the
>>route from a zone to itself always implicitly allowed?
>>
> I think that might be a different issue.  Unless you have done something
> peculiar with your configuration, $FW<->$FW connections should be
> allowed by default.
>
> To properly diagnose this, we will need the output of 'shorewall dump'
> just after a boot/crash.  It would be helpful if you could also include
> other relevant logs (e.g., the Xorg.log).
>
> Regards,
>
> -Roberto
>
>
>
> --
>
>
> ___
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users

--
___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting

[Roberto C . Sánchez]

On Thu, Sep 15, 2016 at 09:18:26AM +0100, Philip Le Riche wrote:
>OK, thanks, so on this near-clone system, systemd is installed and
>systemctl shows  shorewall as disabled. When next I can get to the live
>system (probably next week) I'll repeat it there, and it sounds like it
>should then start on boot.
> 
I hope that fixes the start-on-boot problem for you.

>But does that explain why the desktop crashed when I enabled start-on-boot
>through shorewall.conf and /etc/defaults/shorewall? Does the desktop need
>an ACCEPT $fw $fw rule to talk to its (local) display server, or is the
>route from a zone to itself always implicitly allowed?
> 
I think that might be a different issue.  Unless you have done something
peculiar with your configuration, $FW<->$FW connections should be
allowed by default.

To properly diagnose this, we will need the output of 'shorewall dump'
just after a boot/crash.  It would be helpful if you could also include
other relevant logs (e.g., the Xorg.log).

Regards,

-Roberto

-- 
Roberto C. Sánchez
http://people.connexer.com/~roberto
http://www.connexer.com


signature.asc
Description: Digital signature
--
___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting

[Philip Le Riche]

OK, thanks, so on this near-clone system, systemd is installed and
systemctl shows  shorewall as disabled. When next I can get to the live
system (probably next week) I'll repeat it there, and it sounds like it
should then start on boot.

But does that explain why the desktop crashed when I enabled
start-on-boot through shorewall.conf and /etc/defaults/shorewall? Does
the desktop need an ACCEPT $fw $fw rule to talk to its (local) display
server, or is the route from a zone to itself always implicitly allowed?

Regards - Philip

On 14/09/2016 22:53, Roberto C. Sánchez wrote:
> On Wed, Sep 14, 2016 at 10:40:37PM +0100, Philip Le Riche wrote:
>>It reports:
>>Philip-Desktop ~ # apt-cache policy shorewall
>>shorewall:
>>  Installed: 5.0.4-1
>>
> That version of Shorewall had a packaging bug such that it wouldn't
> start on boot on systems running systemd.
>
>>I'm having difficulty working out what init system it uses and the release
>>notes don't seem to say. (I was brought up on SystemV inittab - I've got
>>the white hair - I just need the walking frame.) Running ps reports
>>process 1 as /sbin/init splash. There's no /etc/inittab but /etc/init is a
>>directory containing loads of .conf files including several
>>upstart-*.conf, smbd.conf and ssh.conf but no shorewall.conf, possibly
>>because I haven't started it.
>>
> What is the output of `apt-cache policy systemd`?  If it reports
> something in the version field for "Installed", then look at the output
> of `systemctl is-enabled shorewall`.  If that spits out "disabled" then
> you can turn it on with `systemctl enable shorewall` and it will start
> on boot as you would expect.
>
> Regards,
>
> -Roberto
>
>
>
> --
>
>
> ___
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users

--
___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting

[Roberto C . Sánchez]

On Wed, Sep 14, 2016 at 10:40:37PM +0100, Philip Le Riche wrote:
>It reports:
>Philip-Desktop ~ # apt-cache policy shorewall
>shorewall:
>  Installed: 5.0.4-1
> 
That version of Shorewall had a packaging bug such that it wouldn't
start on boot on systems running systemd.

>I'm having difficulty working out what init system it uses and the release
>notes don't seem to say. (I was brought up on SystemV inittab - I've got
>the white hair - I just need the walking frame.) Running ps reports
>process 1 as /sbin/init splash. There's no /etc/inittab but /etc/init is a
>directory containing loads of .conf files including several
>upstart-*.conf, smbd.conf and ssh.conf but no shorewall.conf, possibly
>because I haven't started it.
> 
What is the output of `apt-cache policy systemd`?  If it reports
something in the version field for "Installed", then look at the output
of `systemctl is-enabled shorewall`.  If that spits out "disabled" then
you can turn it on with `systemctl enable shorewall` and it will start
on boot as you would expect.

Regards,

-Roberto

-- 
Roberto C. Sánchez
http://people.connexer.com/~roberto
http://www.connexer.com


signature.asc
Description: Digital signature
--
___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting

[Philip Le Riche]

Ah, come to think of it I've got another Linux Mint system down here in
a corner which I set up as far as I can tell identically but it doesn't
have Shorewall configured or started as I don't have the requisite NICs
and only have one network.

It reports:
Philip-Desktop ~ # apt-cache policy shorewall
shorewall:
  Installed: 5.0.4-1
  Candidate: 5.0.4-1
  Version table:
 *** 5.0.4-1 500
500 http://archive.ubuntu.com/ubuntu xenial/universe amd64 Packages
500 http://archive.ubuntu.com/ubuntu xenial/universe i386 Packages
100 /var/lib/dpkg/status

I'm having difficulty working out what init system it uses and the
release notes don't seem to say. (I was brought up on SystemV inittab -
I've got the white hair - I just need the walking frame.) Running ps
reports process 1 as /sbin/init splash. There's no /etc/inittab but
/etc/init is a directory containing loads of .conf files including
several upstart-*.conf, smbd.conf and ssh.conf but no shorewall.conf,
possibly because I haven't started it.

Regards - Philip

On 14/09/2016 21:51, Roberto C. Sánchez wrote:
> On Wed, Sep 14, 2016 at 09:31:12PM +0100, Philip Le Riche wrote:
>>I don't have immediate access to the system and can't easily get precise
>>subversion numbers  but it's running a freshly installed Linux Mint 18 and
>>Shorewall 5 as offered by the standard repository just a few weeks ago.
>>I'm also running Apache2, Samba, isc-dhcp-server and openssh-server. I
>>could be wrong, but to me this has the feel of something to do with the
>>way shorewall and Mint 18 interact rather than something specific to a
>>subversion.
>>
> I am not a Linux Mint user, so I looked on the Mint package listing page
> for the current release and Shorewall is not listed as a package in the
> distribution.  Just tell us the Shorewall package version (output of
> `apt-cache policy shorewall`) so that we can help diagnose the problem.
>
> Also, since you indicated originally that your problem has to do with
> Shorewall not starting at boot, what init system are you using?
>
> Regards,
>
> -Roberto
>
>
>
> --
>
>
> ___
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users

--
___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting

[Roberto C . Sánchez]

On Wed, Sep 14, 2016 at 09:31:12PM +0100, Philip Le Riche wrote:
>I don't have immediate access to the system and can't easily get precise
>subversion numbers  but it's running a freshly installed Linux Mint 18 and
>Shorewall 5 as offered by the standard repository just a few weeks ago.
>I'm also running Apache2, Samba, isc-dhcp-server and openssh-server. I
>could be wrong, but to me this has the feel of something to do with the
>way shorewall and Mint 18 interact rather than something specific to a
>subversion.
> 
I am not a Linux Mint user, so I looked on the Mint package listing page
for the current release and Shorewall is not listed as a package in the
distribution.  Just tell us the Shorewall package version (output of
`apt-cache policy shorewall`) so that we can help diagnose the problem.

Also, since you indicated originally that your problem has to do with
Shorewall not starting at boot, what init system are you using?

Regards,

-Roberto

-- 
Roberto C. Sánchez
http://people.connexer.com/~roberto
http://www.connexer.com


signature.asc
Description: Digital signature
--
___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting

[Philip Le Riche]

I don't have immediate access to the system and can't easily get precise
subversion numbers  but it's running a freshly installed Linux Mint 18
and Shorewall 5 as offered by the standard repository just a few weeks
ago. I'm also running Apache2, Samba, isc-dhcp-server and
openssh-server. I could be wrong, but to me this has the feel of
something to do with the way shorewall and Mint 18 interact rather than
something specific to a subversion.

Regards - Philip

On 14/09/2016 16:33, Roberto C. Sánchez wrote:
> On Wed, Sep 14, 2016 at 04:27:15PM +0100, Philip Le Riche wrote:
>> After a bit of googling I set startup=1 in /etc/default/shorewall and on
>> the next reboot following logon the desktop crashed before displaying
>> anything, dropping me into fallback mode. Now shorewall again doesn't
>> start on boot.
>>
> What version of Shorewall and what installation source (upstream
> installer or distro packages)?
>
> Regards,
>
> -Roberto
>
>
>
> --
>
>
> ___
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users

--
___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting

[Roberto C . Sánchez]

On Wed, Sep 14, 2016 at 04:27:15PM +0100, Philip Le Riche wrote:
> 
> After a bit of googling I set startup=1 in /etc/default/shorewall and on
> the next reboot following logon the desktop crashed before displaying
> anything, dropping me into fallback mode. Now shorewall again doesn't
> start on boot.
> 
What version of Shorewall and what installation source (upstream
installer or distro packages)?

Regards,

-Roberto

-- 
Roberto C. Sánchez
http://people.connexer.com/~roberto
http://www.connexer.com


signature.asc
Description: Digital signature
--
___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting on boot - eth0 not up yet

[Tom Eastep]

On 11/20/2014 3:38 AM, Philip Le Riche wrote:
> On 11/20/2014 00:42 AM, Tom Eastep wrote:
> 
> No -- but they are pretty obvious. Given the error message you are
> seeing, something you are doing requires the IP address of eth0. Some
> possibilities are:
> 
> - You are calling find_first_interface_address() in your params file
> - You have used "ð0" or "%eth0" in one of your files
> - You have used "detect:" in a rule.
> - You have entered "detect" in the ADDRESS column in the masq file
> 
> Thanks Tom, and yes, that seems to be it. I have the Address column in
> masq as detect, probably for historical reasons from when I was setting
> it up in a test environment. That interface now has 17 IP addresses
> (recently increased from 9), 16 associated with DNAT rules. So masq
> would have been using them all as masqueraded adresses, which is not
> what I intended.

Actually, only the first IP address is used for SNAT when 'detect' is
specified.

-Tom
-- 
Tom Eastep\ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \



signature.asc
Description: OpenPGP digital signature
--
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting on boot - eth0 not up yet

[Philip Le Riche]

On 11/20/2014 00:42 AM, Tom Eastep wrote:

No -- but they are pretty obvious. Given the error message you are
seeing, something you are doing requires the IP address of eth0. Some
possibilities are:

- You are calling find_first_interface_address() in your params file
- You have used "ð0" or "%eth0" in one of your files
- You have used "detect:" in a rule.
- You have entered "detect" in the ADDRESS column in the masq file

Thanks Tom, and yes, that seems to be it. I have the Address column in
masq as detect, probably for historical reasons from when I was setting
it up in a test environment. That interface now has 17 IP addresses
(recently increased from 9), 16 associated with DNAT rules. So masq
would have been using them all as masqueraded adresses, which is not
what I intended.

Regards - Philip

--
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting on boot - eth0 not up yet

[Tom Eastep]

On 11/19/2014 3:12 AM, Philip Le Riche wrote:
> Thanks Tom - it sounds like adding something like "required,wait=5"
> would at least be a viable work-around.

Yes.

> 
> But reading between the lines, it seems you're saying that I could in
> all likelihood sidestep the problem completely, just by specifying
> "optional" instead (I presume "required" is the default - the man page
> is silent on that.)

The default is neither "required" nor "optional". The firewall will
start even if the interface doesn't exist, provided that you haven't
used a configuration construct that requires the interface to be up in
order to start.

Is there a discussion somewhere of what
> configurations require "required"?
> 

No -- but they are pretty obvious. Given the error message you are
seeing, something you are doing requires the IP address of eth0. Some
possibilities are:

- You are calling find_first_interface_address() in your params file
- You have used "ð0" or "%eth0" in one of your files
- You have used "detect:" in a rule.
- You have entered "detect" in the ADDRESS column in the masq file

-Tom
-- 
Tom Eastep\ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \



signature.asc
Description: OpenPGP digital signature
--
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting on boot - eth0 not up yet

[Philip Le Riche]

Thanks Tom - it sounds like adding something like "required,wait=5"
would at least be a viable work-around.

But reading between the lines, it seems you're saying that I could in
all likelihood sidestep the problem completely, just by specifying
"optional" instead (I presume "required" is the default - the man page
is silent on that.) Is there a discussion somewhere of what
configurations require "required"?

Regards - Philip

On 18/11/2014 16:47, Tom Eastep wrote:
> On 11/18/2014 1:12 AM, Philip Le Riche wrote:
>> I'm using Shorewall to protect a school network from a classroom network
>> of Raspberry Pis, which are operated headless from school network PCs using 
>> VNC or PuTTy.
>>
>> All was working fine, starting up successfully on boot until I did the
>> following:
>> Installed isc-dhcp-server to serve dhcp to guest Pis
>> Installed Apache2 and a cgi script to report DHCP leases
>> Added 8 more fixed IP addresses to the school NIC and 8 more DNAT rules
>> (bringing it to 16) mapping them to classroom IP addresses
>> Installed OpenSSH for firewall maintenance
>> Added Shorewall ACCEPT rules with destination $FW for the above.
>>
>> Now Shorewall doesn't start on boot, and neither does sshd, but both
>> start successfully if you log in and type shorewall start and service
>> sshd start. (Apache and dhcp-server start up ok.)
>>
>> The problem seems to be that eth0 is still not up by the time the
>> Shorewall and sshd init scripts get run. In shorewall-init.log there are
>> messages "Can't determine the IP address of eth0"
> You have configured Shorewall so that eth0 *must* be up before Shorewall
> can start. If that is really necessary (which I rather doubt), then:
>
> a) Specify 'required' on the eth0 entry in /etc/shorewall/interfaces
> b) Additionally, specify 'wait=N' where N is the number of seconds that
> you are willing to wait for eth0 to come up.
>
> -Tom
>
>
> --
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>
>
> ___
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users

--
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting n boot - eth0 not up yet

[Tom Eastep]

On 11/18/2014 1:12 AM, Philip Le Riche wrote:
> I'm using Shorewall to protect a school network from a classroom network
> of Raspberry Pis, which are operated headless from school network PCs using 
> VNC or PuTTy.
> 
> All was working fine, starting up successfully on boot until I did the
> following:
> Installed isc-dhcp-server to serve dhcp to guest Pis
> Installed Apache2 and a cgi script to report DHCP leases
> Added 8 more fixed IP addresses to the school NIC and 8 more DNAT rules
> (bringing it to 16) mapping them to classroom IP addresses
> Installed OpenSSH for firewall maintenance
> Added Shorewall ACCEPT rules with destination $FW for the above.
> 
> Now Shorewall doesn't start on boot, and neither does sshd, but both
> start successfully if you log in and type shorewall start and service
> sshd start. (Apache and dhcp-server start up ok.)
> 
> The problem seems to be that eth0 is still not up by the time the
> Shorewall and sshd init scripts get run. In shorewall-init.log there are
> messages "Can't determine the IP address of eth0"

You have configured Shorewall so that eth0 *must* be up before Shorewall
can start. If that is really necessary (which I rather doubt), then:

a) Specify 'required' on the eth0 entry in /etc/shorewall/interfaces
b) Additionally, specify 'wait=N' where N is the number of seconds that
you are willing to wait for eth0 to come up.

-Tom
-- 
Tom Eastep\ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \



signature.asc
Description: OpenPGP digital signature
--
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting on boot - eth0 not up yet

[Philip Le Riche]

wait_interface is null. Definitely sounds like worth a try. I've also
been looking at IFUPDOWN in /etc/default/shorewall-init. Would you
recommend that as well, or instead? Unfortunately I only get access to
the firewall once a week, which will be tomorrow, so any other ideas
will be very timely.

Regards - Philip

On 18/11/2014 12:40, Wayne S wrote:
> At 11/18/2014 04:12 AM, Philip Le Riche wrote:
>> ...
>> Shorewall is running under Linux Mint 16.
>>
>> It may be arguable whether the Shorewall (and sshd) init scripts are at
>> fault or whether the fault lies with networking startup, but it must be
>> an issue other people round here have hit. Is there a recognised fix,
>> either to delay startup of Shorewall (and sshd), or to ensure networking
>> runs to completion before dependant init scripts are run? Googling for
>> the sshd half of the problem only seems to come up with sticking plaster
>> solutions.
>>
>> Regards - Philip
>
> What is the setting in /etc/default/shorewall for
>
> wait_interface=??
>
> If not set, try setting it.
>
> Wayne
>
>
> --
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>
>
> ___
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users

--
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting n boot - eth0 not up yet

[Wayne S]

At 11/18/2014 04:12 AM, Philip Le Riche wrote:
>...
>Shorewall is running under Linux Mint 16.
>
>It may be arguable whether the Shorewall (and sshd) init scripts are at
>fault or whether the fault lies with networking startup, but it must be
>an issue other people round here have hit. Is there a recognised fix,
>either to delay startup of Shorewall (and sshd), or to ensure networking
>runs to completion before dependant init scripts are run? Googling for
>the sshd half of the problem only seems to come up with sticking plaster
>solutions.
>
>Regards - Philip

What is the setting in /etc/default/shorewall for

wait_interface=??

If not set, try setting it.

Wayne
--
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting n boot - eth0 not up yet

[Wayne S]

At 11/18/2014 04:12 AM, Philip Le Riche wrote:
>...
>Shorewall is running under Linux Mint 16.
>
>It may be arguable whether the Shorewall (and sshd) init scripts are at
>fault or whether the fault lies with networking startup, but it must be
>an issue other people round here have hit. Is there a recognised fix,
>either to delay startup of Shorewall (and sshd), or to ensure networking
>runs to completion before dependant init scripts are run? Googling for
>the sshd half of the problem only seems to come up with sticking plaster
>solutions.
>
>Regards - Philip

What is the setting in /etc/default/shorewall for

wait_interface=??

If not set, try setting it.

Wayne
--
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting n boot - eth0 not up yet

[Philip Le Riche]

No, I believe it uses Upstart.

- Philip

On 18/11/2014 09:44, Artur Uszyński wrote:
> Is Mint 16 using systemd ?
>
> --
> Artur
>
> W dniu 18.11.2014 o 10:12, Philip Le Riche pisze:
>> I'm using Shorewall to protect a school network from a classroom network
>> of Raspberry Pis, which are operated headless from school network PCs using 
>> VNC or PuTTy.
>>
>> All was working fine, starting up successfully on boot until I did the
>> following:
>> Installed isc-dhcp-server to serve dhcp to guest Pis
>> Installed Apache2 and a cgi script to report DHCP leases
>> Added 8 more fixed IP addresses to the school NIC and 8 more DNAT rules
>> (bringing it to 16) mapping them to classroom IP addresses
>> Installed OpenSSH for firewall maintenance
>> Added Shorewall ACCEPT rules with destination $FW for the above.
>>
>> Now Shorewall doesn't start on boot, and neither does sshd, but both
>> start successfully if you log in and type shorewall start and service
>> sshd start. (Apache and dhcp-server start up ok.)
>>
>> The problem seems to be that eth0 is still not up by the time the
>> Shorewall and sshd init scripts get run. In shorewall-init.log there are
>> messages "Can't determine the IP address of eth0" and in
>> /var/log/auth.log there are sshd messages "Cannot bind any address".
>>
>> Shorewall is running under Linux Mint 16.
>>
>> It may be arguable whether the Shorewall (and sshd) init scripts are at
>> fault or whether the fault lies with networking startup, but it must be
>> an issue other people round here have hit. Is there a recognised fix,
>> either to delay startup of Shorewall (and sshd), or to ensure networking
>> runs to completion before dependant init scripts are run? Googling for
>> the sshd half of the problem only seems to come up with sticking plaster
>> solutions.
>>
>> Regards - Philip
>>
>>
>> --
>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>> Get technology previously reserved for billion-dollar corporations, FREE
>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>> ___
>> Shorewall-users mailing list
>> Shorewall-users@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>>
>
> --
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> ___
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>


--
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting n boot - eth0 not up yet

[Artur Uszyński]

Is Mint 16 using systemd ?

--
Artur

W dniu 18.11.2014 o 10:12, Philip Le Riche pisze:
> I'm using Shorewall to protect a school network from a classroom network
> of Raspberry Pis, which are operated headless from school network PCs using 
> VNC or PuTTy.
>
> All was working fine, starting up successfully on boot until I did the
> following:
> Installed isc-dhcp-server to serve dhcp to guest Pis
> Installed Apache2 and a cgi script to report DHCP leases
> Added 8 more fixed IP addresses to the school NIC and 8 more DNAT rules
> (bringing it to 16) mapping them to classroom IP addresses
> Installed OpenSSH for firewall maintenance
> Added Shorewall ACCEPT rules with destination $FW for the above.
>
> Now Shorewall doesn't start on boot, and neither does sshd, but both
> start successfully if you log in and type shorewall start and service
> sshd start. (Apache and dhcp-server start up ok.)
>
> The problem seems to be that eth0 is still not up by the time the
> Shorewall and sshd init scripts get run. In shorewall-init.log there are
> messages "Can't determine the IP address of eth0" and in
> /var/log/auth.log there are sshd messages "Cannot bind any address".
>
> Shorewall is running under Linux Mint 16.
>
> It may be arguable whether the Shorewall (and sshd) init scripts are at
> fault or whether the fault lies with networking startup, but it must be
> an issue other people round here have hit. Is there a recognised fix,
> either to delay startup of Shorewall (and sshd), or to ensure networking
> runs to completion before dependant init scripts are run? Googling for
> the sshd half of the problem only seems to come up with sticking plaster
> solutions.
>
> Regards - Philip
>
>
> --
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> ___
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>


--
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting on kernel 3.13

[Tom Eastep]

On 3/17/2014 3:34 PM, Kilburn Abrahams wrote:
> Hi Tony
> 
> Applied patch. No difference. 'shorewall debug restart' show same as before.
> 

The error message should have been different and I want to see it.

Thanks,
-Tom
-- 
Tom Eastep\ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \



signature.asc
Description: OpenPGP digital signature
--
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting on kernel 3.13

[Kilburn Abrahams]

Hi Tony

Applied patch. No difference. 'shorewall debug restart' show same as before.

Thanks

 
On 03/18/2014 08:07 AM, Tom Eastep wrote:
> On 3/17/2014 1:56 PM, Kilburn Abrahams wrote:
>> Hi Tony
>>
>> Here is a small extract. Yes it does
>>
>> SBox linux # shorewall show capabilities
>> Shorewall has detected the following iptables/netfilter capabilities:
>>ACCOUNT Target (ACCOUNT_TARGET): Not available
>>Address Type Match (ADDRTYPE): Available
>>Amanda Helper: Available
>>Arptables JF: Not available
>>AUDIT Target (AUDIT_TARGET): Available
>>Basic Filter (BASIC_FILTER): Available
>>Capabilities Version (CAPVERSION): 40515
>>Checksum Target: Available
>>CLASSIFY Target (CLASSIFY_TARGET): Available
>>Comments (COMMENTS): Available
>>Condition Match (CONDITION_MATCH): Not available
>>Connection Tracking Match (CONNTRACK_MATCH): Available
>>Connlimit Match (CONNLIMIT_MATCH): Available
>>Connmark Match (CONNMARK_MATCH): Available
>>CONNMARK Target (CONNMARK): Available
>>CT Target (CT_TARGET): Available
>>DSCP Match (DSCP_MATCH): Available
>>DSCP Target (DSCP_TARGET): Available
> Please apply the attached patch and try 'shorewall debug restart' again.
>
>   patch /usr/share/shorewall/lib.core < TABLE.patch
>
> Thanks,
> -Tom
>
>
> --
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech
>
>
> ___
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users

--
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting on kernel 3.13

[Tom Eastep]

On 3/17/2014 1:56 PM, Kilburn Abrahams wrote:
> Hi Tony
> 
> Here is a small extract. Yes it does
> 
> SBox linux # shorewall show capabilities
> Shorewall has detected the following iptables/netfilter capabilities:
>ACCOUNT Target (ACCOUNT_TARGET): Not available
>Address Type Match (ADDRTYPE): Available
>Amanda Helper: Available
>Arptables JF: Not available
>AUDIT Target (AUDIT_TARGET): Available
>Basic Filter (BASIC_FILTER): Available
>Capabilities Version (CAPVERSION): 40515
>Checksum Target: Available
>CLASSIFY Target (CLASSIFY_TARGET): Available
>Comments (COMMENTS): Available
>Condition Match (CONDITION_MATCH): Not available
>Connection Tracking Match (CONNTRACK_MATCH): Available
>Connlimit Match (CONNLIMIT_MATCH): Available
>Connmark Match (CONNMARK_MATCH): Available
>CONNMARK Target (CONNMARK): Available
>CT Target (CT_TARGET): Available
>DSCP Match (DSCP_MATCH): Available
>DSCP Target (DSCP_TARGET): Available

Please apply the attached patch and try 'shorewall debug restart' again.

patch /usr/share/shorewall/lib.core < TABLE.patch

Thanks,
-Tom
-- 
Tom Eastep\ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \
diff --git a/Shorewall/Perl/lib.core b/Shorewall/Perl/lib.core
index 8901b4e..088475f 100644
--- a/Shorewall/Perl/lib.core
+++ b/Shorewall/Perl/lib.core
@@ -545,7 +545,7 @@ debug_restore_input() {
 		eval $g_tool -t $table $first $second $rest
 
 		if [ $? -ne 0 ]; then
-		error_message "ERROR: Command \"$g_tool $first $second $rest\" Failed"
+		error_message "ERROR: Command \"$g_tool -t $table $first $second $rest\" Failed"
 		stop_firewall
 		exit 2
 		fi


signature.asc
Description: OpenPGP digital signature
--
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting on kernel 3.13

[Kilburn Abrahams]

Hi Tony

Here is a small extract. Yes it does

SBox linux # shorewall show capabilities
Shorewall has detected the following iptables/netfilter capabilities:
   ACCOUNT Target (ACCOUNT_TARGET): Not available
   Address Type Match (ADDRTYPE): Available
   Amanda Helper: Available
   Arptables JF: Not available
   AUDIT Target (AUDIT_TARGET): Available
   Basic Filter (BASIC_FILTER): Available
   Capabilities Version (CAPVERSION): 40515
   Checksum Target: Available
   CLASSIFY Target (CLASSIFY_TARGET): Available
   Comments (COMMENTS): Available
   Condition Match (CONDITION_MATCH): Not available
   Connection Tracking Match (CONNTRACK_MATCH): Available
   Connlimit Match (CONNLIMIT_MATCH): Available
   Connmark Match (CONNMARK_MATCH): Available
   CONNMARK Target (CONNMARK): Available
   CT Target (CT_TARGET): Available
   DSCP Match (DSCP_MATCH): Available
   DSCP Target (DSCP_TARGET): Available

On 03/18/2014 07:50 AM, Tom Eastep wrote:
> On 3/17/2014 1:19 PM, Kilburn Abrahams wrote:
>> Hi Tony
>>
>> This is what I am getting. Is there something in the kernel that is not
>> compiled in. I compared and checked in it looks fine.
>>
>> Thanks
>>
>> SBox shorewall # shorewall debug start
> ...
>> Preparing iptables-restore input...
>> Running debug_restore_input...
>> iptables: No chain/target/match by that name.
>>ERROR: Command "/sbin/iptables -A PREROUTING -p 17 --dport 1719 -j CT
>> --helper RAS" Failed
> Does 'shorewall show capabilities' indicate that you have the 'CT
> Target' capability?
>
> Thanks,
> -Tom
>
>
> --
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech
>
>
> ___
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users

--
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting on kernel 3.13

[Tom Eastep]

On 3/17/2014 1:19 PM, Kilburn Abrahams wrote:
> Hi Tony
> 
> This is what I am getting. Is there something in the kernel that is not
> compiled in. I compared and checked in it looks fine.
> 
> Thanks
> 
> SBox shorewall # shorewall debug start

...
> Preparing iptables-restore input...
> Running debug_restore_input...
> iptables: No chain/target/match by that name.
>ERROR: Command "/sbin/iptables -A PREROUTING -p 17 --dport 1719 -j CT
> --helper RAS" Failed

Does 'shorewall show capabilities' indicate that you have the 'CT
Target' capability?

Thanks,
-Tom
-- 
Tom Eastep\ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \



signature.asc
Description: OpenPGP digital signature
--
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting on kernel 3.13

[Kilburn Abrahams]

Hi Tony

This is what I am getting. Is there something in the kernel that is not
compiled in. I compared and checked in it looks fine.

Thanks

SBox shorewall # shorewall debug start
Compiling...
Processing /etc/shorewall/params ...
Processing /etc/shorewall/shorewall.conf...
Compiling /etc/shorewall/zones...
Compiling /etc/shorewall/interfaces...
Determining Hosts in Zones...
Locating Action Files...
Compiling /etc/shorewall/policy...
Running /etc/shorewall/initdone...
Adding Anti-smurf Rules
Adding rules for DHCP
Compiling TCP Flags filtering...
Compiling Kernel Route Filtering...
Compiling Martian Logging...
Compiling MAC Filtration -- Phase 1...
Compiling /etc/shorewall/blrules...
Compiling /etc/shorewall/rules...
Compiling /etc/shorewall/conntrack...
Compiling MAC Filtration -- Phase 2...
Applying Policies...
Compiling /usr/share/shorewall/action.Drop for chain Drop...
Compiling /usr/share/shorewall/action.Broadcast for chain Broadcast...
Compiling /etc/shorewall/accounting...
Generating Rule Matrix...
Compiling /usr/share/shorewall/action.Reject for chain Reject...
Creating iptables-restore input...
Compiling /etc/shorewall/routestopped...
Shorewall configuration compiled to /var/lib/shorewall/.start
Starting Shorewall
Initializing...
Processing /etc/shorewall/init ...
Processing /etc/shorewall/tcclear ...
Setting up Route Filtering...
Setting up Martian Logging...
Setting up Proxy ARP...
Preparing iptables-restore input...
Running debug_restore_input...
iptables: No chain/target/match by that name.
   ERROR: Command "/sbin/iptables -A PREROUTING -p 17 --dport 1719 -j CT
--helper RAS" Failed
Processing /etc/shorewall/stop ...
Processing /etc/shorewall/tcclear ...
Running debug_restore_input...
IPv4 Forwarding Enabled
Processing /etc/shorewall/stopped ...
/usr/share/shorewall/lib.common: line 113: 13829 Terminated 
$SHOREWALL_SHELL $script $options $@

On 03/18/2014 01:43 AM, Tom Eastep wrote:
> On 3/17/2014 5:08 AM, Kilburn Abrahams wrote:
>> Hi all
>>
>> Rebuilt a server with kernel 3.13. Installed the same version of
>> shorewall 4.5.18 as a working server. Copied over shorewall configs.
>> Restarted shorewall and this happens. Googled and could not find
>> anything. Not sure how to solve this.
>>
>> SBox shorewall # /etc/init.d/shorewall start
>>  * Caching service dependencies
>> ...  
>> 
>> [ ok ]
>>  * Starting shorewall ...
>> iptables-restore: line 23 failed
>>ERROR: iptables-restore Failed. Input is in
>> /var/lib/shorewall/.iptables-restore-input
>> /usr/share/shorewall/lib.common: line 113: 10488 Terminated 
>> $SHOREWALL_SHELL $script $options $@ [ !! ]
>>  * ERROR: shorewall failed to start
>>
>> /var/lib/shorewall/.iptables-restore-input does indicate where the
>> problem might lie.
> 'does' or 'does not'?
>
> If line 23 is a COMMIT line, then you can gather additional information
> using "shorewall debug start", which will give you the exact rule that
> is causing the issue. You might also see something in the system log.
>
> -Tom
>
>
> --
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech
>
>
> ___
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users

--
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting on kernel 3.13

[Tom Eastep]

On 3/17/2014 5:08 AM, Kilburn Abrahams wrote:
> Hi all
> 
> Rebuilt a server with kernel 3.13. Installed the same version of
> shorewall 4.5.18 as a working server. Copied over shorewall configs.
> Restarted shorewall and this happens. Googled and could not find
> anything. Not sure how to solve this.
> 
> SBox shorewall # /etc/init.d/shorewall start
>  * Caching service dependencies
> ...   
>
> [ ok ]
>  * Starting shorewall ...
> iptables-restore: line 23 failed
>ERROR: iptables-restore Failed. Input is in
> /var/lib/shorewall/.iptables-restore-input
> /usr/share/shorewall/lib.common: line 113: 10488 Terminated 
> $SHOREWALL_SHELL $script $options $@ [ !! ]
>  * ERROR: shorewall failed to start
> 
> /var/lib/shorewall/.iptables-restore-input does indicate where the
> problem might lie.

'does' or 'does not'?

If line 23 is a COMMIT line, then you can gather additional information
using "shorewall debug start", which will give you the exact rule that
is causing the issue. You might also see something in the system log.

-Tom
-- 
Tom Eastep\ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \



signature.asc
Description: OpenPGP digital signature
--
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting correctly

[Tom Eastep]

On 03/24/2013 02:18 PM, Donald S. Doyle wrote:

> On Ubuntu 12.10, accessing through Webmin, I am running v4.5.5.3.  I can
> manually start Shorewall by clicking the Start Firewall button, but it
> does not start automatically.  In the shorewall.conf file, I have
> startup_enabled set to YES.  

Edit /etc/default/shorewall and set STARTUP=1

-Tom
-- 
Tom Eastep\ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \



signature.asc
Description: OpenPGP digital signature
--
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting correctly

[Roberto C . Sánchez]

Hi Donald,

Have you set "startup=1" in /etc/default/shorewall (or
/etc/default/shorewall6, as applicable)?

Regards,

-Roberto

On Sun, Mar 24, 2013 at 05:28:25PM -0400, Donald S. Doyle wrote:
>Hello,
> 
> 
> 
>Let’s try this again.  Compressed version of the trace file.
> 
> 
> 
>Have a great day,
> 
> 
> 
>Donald S. Doyle
> 
>President
>G.E.M. Computer Consulting, LLC
> 
>317.250.4448
> 
>[1]www.gemcc.com
> 
> 
> 
>[2]gem-logo
> 
> 
> 
>CONFIDENTIALITY NOTICE
> 
>The materials enclosed with this electronic transmission are private and
>confidential and are the properties of the sender.  The information
>contained in the material is privileged and is intended only for the use
>of the individual(s) or entity (ies) named above.  If you are not the
>intended recipient, be advised that any unauthorized disclosure, copying,
>distribution, or the taking of any action in reliance on the contents of
>this information is strictly prohibited.  If you have received this
>electronic transmission in error, please notify us by telephone.
> 
> 
> 
> 
> 
> 
> 
>From: Donald S. Doyle [mailto:dsdo...@gemcc.com]
>Sent: Sunday, March 24, 2013 5:19 PM
>To: 'shorewall-users@lists.sourceforge.net'
>Subject: Shorewall not starting correctly
> 
> 
> 
>Hello,
> 
> 
> 
>On Ubuntu 12.10, accessing through Webmin, I am running v4.5.5.3.  I can
>manually start Shorewall by clicking the Start Firewall button, but it
>does not start automatically.  In the shorewall.conf file, I have
>startup_enabled set to YES.  If I go to Bootup and Shutdown within Webmin,
>Shorewall is listed as Start at boot as yes, but Running now is saying No,
>even though I just manually started it and I know it is running.  Also,
>using MON service monitor, it says “not running as GID uucp, are you using
>the setgid wrapper?”
> 
> 
> 
>Any ideas?  Thanks in advance.
> 
> 
> 
>Have a great day,
> 
> 
> 
>Donald S. Doyle
> 
>President
>G.E.M. Computer Consulting, LLC
> 
>317.250.4448
> 
>[3]www.gemcc.com
> 
> 
> 
>[4]gem-logo
> 
> 
> 
>CONFIDENTIALITY NOTICE
> 
>The materials enclosed with this electronic transmission are private and
>confidential and are the properties of the sender.  The information
>contained in the material is privileged and is intended only for the use
>of the individual(s) or entity (ies) named above.  If you are not the
>intended recipient, be advised that any unauthorized disclosure, copying,
>distribution, or the taking of any action in reliance on the contents of
>this information is strictly prohibited.  If you have received this
>electronic transmission in error, please notify us by telephone.
> 
> 
> 
> 
> 
> References
> 
>Visible links
>1. http://www.gemcc.com/
>2. http://www.gemcc.com/
>3. http://www.gemcc.com/
>4. http://www.gemcc.com/




> --
> Everyone hates slow websites. So do we.
> Make your web apps faster with AppDynamics
> Download AppDynamics Lite for free today:
> http://p.sf.net/sfu/appdyn_d2d_mar

> ___
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users


-- 
Roberto C. Sánchez
http://people.connexer.com/~roberto
http://www.connexer.com


signature.asc
Description: Digital signature
--
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Re: [Shorewall-users] Shorewall not starting correctly

[Donald S. Doyle]

Hello,

 

Let's try this again.  Compressed version of the trace file.

 

Have a great day,

 

Donald S. Doyle

President
G.E.M. Computer Consulting, LLC

317.250.4448

www.gemcc.com

 

  gem-logo

 

CONFIDENTIALITY NOTICE

The materials enclosed with this electronic transmission are private and
confidential and are the properties of the sender.  The information
contained in the material is privileged and is intended only for the use of
the individual(s) or entity (ies) named above.  If you are not the intended
recipient, be advised that any unauthorized disclosure, copying,
distribution, or the taking of any action in reliance on the contents of
this information is strictly prohibited.  If you have received this
electronic transmission in error, please notify us by telephone.

 

 

 

From: Donald S. Doyle [mailto:dsdo...@gemcc.com] 
Sent: Sunday, March 24, 2013 5:19 PM
To: 'shorewall-users@lists.sourceforge.net'
Subject: Shorewall not starting correctly

 

Hello,

 

On Ubuntu 12.10, accessing through Webmin, I am running v4.5.5.3.  I can
manually start Shorewall by clicking the Start Firewall button, but it does
not start automatically.  In the shorewall.conf file, I have startup_enabled
set to YES.  If I go to Bootup and Shutdown within Webmin, Shorewall is
listed as Start at boot as yes, but Running now is saying No, even though I
just manually started it and I know it is running.  Also, using MON service
monitor, it says "not running as GID uucp, are you using the setgid
wrapper?"

 

Any ideas?  Thanks in advance.

 

Have a great day,

 

Donald S. Doyle

President
G.E.M. Computer Consulting, LLC

317.250.4448

www.gemcc.com

 

  gem-logo

 

CONFIDENTIALITY NOTICE

The materials enclosed with this electronic transmission are private and
confidential and are the properties of the sender.  The information
contained in the material is privileged and is intended only for the use of
the individual(s) or entity (ies) named above.  If you are not the intended
recipient, be advised that any unauthorized disclosure, copying,
distribution, or the taking of any action in reliance on the contents of
this information is strictly prohibited.  If you have received this
electronic transmission in error, please notify us by telephone.

 

 

<>

trace.gz
Description: Binary data
--
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar___
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users