I have been using shorewall for years with ipsets. I have encountered a problem after upgrading from 4.2.11 to 4.4.10. When I run 'shorewall-check' or 'shorewall start', it halts with the error: ---------------------------------------------------------------------- ERROR: ipset names in Shorewall configuration files require Ipset Match in your kernel and iptables : /etc/shorewall/rules (line 16) ----------------------------------------------------------------------
(For the purposes of demonstrating this I have removed all references to ipsets in my rules and blacklist files except the one mentioned above.) Other information: 1. I upgraded shorewall in isolation, making no other changes to my system. Note that the system was running shorewall-perl 4.2.11 with ipsets just fine. 2. Shorewall 4.4.10 reports that the ipset "capability" is present: --------------------------------------------------------------------- # shorewall show capabilities | grep Ipset Ipset Match: Available # shorewall show -f capabilities | grep IPSET IPSET_MATCH=Yes --------------------------------------------------------------------- 3. The modules are loaded: --------------------------------------------------------------------- twister shorewall # lsmod Module Size Used by ip_set_setlist 2444 1 ipt_set 843 0 ipt_SET 1012 0 ip_set_nethash 7396 4 ip_set_iptreemap 7504 0 ip_set_iptree 4068 0 ip_set_ipporthash 6780 0 ip_set_portmap 2358 0 ip_set_macipmap 2198 0 ip_set_ipmap 2226 0 ip_set_iphash 5756 1 ip_set 9944 20 ip_set_setlist,ipt_set,ipt_SET,ip_set_nethash,ip_set_iptreemap,ip_set_iptree,ip_set_ipporthash,ip_set_portmap,ip_set_macipmap,ip_set_ipmap,ip_set_iphash ---------------------------------------------------------------------- 4. With "SAVE_IPSETS=Yes", Shorewall 4.4.10 even saves and restores my ipsets (while simultaneously claiming the capability to be absent and refusing to start if an ipset is present in the rules or blacklist): ---------------------------------------------------------------------- # ls -l /var/lib/shorewall total 444 -rw-r----- 1 root root 0 Oct 27 2008 chains -rwx------ 1 root root 78551 Jun 16 23:48 firewall -rw------- 1 root root 123212 Jun 16 23:46 ipsets.save -rw------- 1 root root 0 Jun 16 23:48 nat -rw------- 1 root root 450 Jun 16 23:48 policies -rw------- 1 root root 0 Jun 16 23:48 proxyarp -rw-r----- 1 root root 29 Jun 16 23:48 restarted -rwx--x--x 1 root root 78551 Jun 16 23:41 restore -rw-r----- 1 root root 123212 Jun 16 23:41 restore-ipsets -rw-r----- 1 root root 18561 Jun 16 23:41 restore-iptables -rw-r----- 1 root root 39 Jun 16 23:48 state -rw-r----- 1 root root 84 Jun 16 23:48 zones --------------------------------------------------------------------- 5. Software versions: shorewall 4.4.10 iptables 1.4.8 ipset 4.2 perl 5.8.8 I would be appreciative of any insight into what is going on here. Thank you, John ------------------------------------------------------------------------------ ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win: http://p.sf.net/sfu/thinkgeek-promo _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
