[Shorewall-users] iptables: Invalid argument

Joshua Banks
Wed, 10 Sep 2003 00:47:12 -0000

Hard to say without any experience picking apart iptables data. I''m
surprised no one has answered
this yet. Phil it looks as though you''ve given all the correct info. If
this isn''t working then I
would uninstall this and reinstall. You have a setup similar to mine. Really
doesn''t get any
easier than the way you have this setup. So a simple unistall reinstall is a
very simple work
around for now. Thats if you need this working ASP.

Wish I could''ve been more helpful. The only thing that I was thinking
is that there was possibly
some whitespace detected when you edited a file...Thats just a guess..

JBanks
--- Phil Tomson <ptkwt@aracnet.com> wrote:
>
>
> I was starting shorewall _after_ ppp0 was up.
>
> Phil
>
> On Tue, 9 Sep 2003, Jerry Vonau wrote:
>
> > Phil:
> >
> > You are starting shorewall before the interface is up...
> > use the /etc/ppp/ip-up.local file to (re)start shorewall
> >
> > see:
> > http://www.shorewall.net/starting_and_stopping_shorewall.htm
> > Important Notes: 2
> >
> > Jerry Vonau
> >
> >
> >
> >
> >
> > ----- Original Message -----
> > From: "Phil Tomson" <ptkwt@aracnet.com>
> > To: <shorewall-users@lists.shorewall.net>
> > Sent: Tuesday, September 09, 2003 07:35 PM
> > Subject: [Shorewall-users] iptables: Invalid argument
> >
> >
> > >
> > > Here''s what I''m seeing when I try to start
shorewall:
> > >
> > > [root@jed shorewall]# ../init.d/shorewall restart
> > > Processing /etc/shorewall/params ...
> > > Shorewall Not Currently Running
> > > Starting Shorewall...
> > > Loading Modules...
> > > Initializing...
> > > Determining Zones...
> > >    Zones: net loc
> > > Validating interfaces file...
> > > Validating hosts file...
> > > Validating Policy file...
> > > Determining Hosts in Zones...
> > >    Net Zone: ppp0:0.0.0.0/0
> > >    Local Zone: eth0:0.0.0.0/0
> > > Processing /etc/shorewall/init ...
> > > Deleting user chains...
> > > Creating input Chains...
> > > Configuring Proxy ARP
> > > Setting up NAT...
> > > Adding Common Rules
> > > Adding rules for DHCP
> > > IP Forwarding Enabled
> > > Processing /etc/shorewall/tunnels...
> > > Processing /etc/shorewall/rules...
> > >    Rule "ACCEPT fw net tcp 53" added.
> > >    Rule "ACCEPT fw net udp 53" added.
> > >    Rule "ACCEPT loc net tcp 53" added.
> > >    Rule "ACCEPT loc net udp 53" added.
> > >    Rule "ACCEPT loc fw tcp 22" added.
> > >    Rule "ACCEPT loc net tcp 22" added.
> > >    Rule "ACCEPT loc fw icmp 8" added.
> > >    Rule "ACCEPT net fw icmp 8" added.
> > > Processing /etc/shorewall/policy...
> > >    Policy ACCEPT for fw to net using chain fw2net
> > >    Policy ACCEPT for fw to loc using chain fw2loc
> > >    Policy DROP for net to fw using chain net2all
> > >    Policy ACCEPT for loc to fw using chain loc2all
> > >    Policy ACCEPT for loc to net using chain loc2net
> > > Masqueraded Subnets and Hosts:
> > > iptables: Invalid argument
> > > Processing /etc/shorewall/stop ...
> > > Processing /etc/shorewall/stopped ...
> > > Terminated
> > >
> > >
> > > I noticed from the above that the something was wrong in the masq
file, so
> > > I removed it and then shorewall started OK (but masquerading
doesn''t work
> > > because there''s no masq file).  My masq file only
contains the following:
> > >
> > > #INTERFACE         SUBNET ADDRESS
> > > ppp0                    eth0
> > >
> > >
> > > ...that''s it.  I connect to the internet via ppp0 and
eth0 conntects to
> > > the hub and two other computers.
> > >
> > > shorewall version:
> > > 1.3.14a
> > >
> > > uname -a
> > > Linux jed.home.com 2.4.19-16mdk #1 Fri Sep 20 18:15:05 CEST 2002
i686
> > >
> > > Mandrake 9.1 (with the older 2.4.19-16mdk kernel - the 2.4.21
kernel which
> > > came with 9.1 caused my system to hang when accessing the CDROM,
so I''m
> > > using the older one - BTW: I was running shorewall on this
machine/kernel
> > > prior to the upgrade to 9.1, the kernel is identical to the one I
used
> > > with 9.0 which was running shorewall OK.)
> > >
> > > ip addr show
> > > 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
> > >     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
> > >     inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
> > > 2: e
> > >
> > > th0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast
qlen 100
> > >     link/ether 00:d0:09:c4:3d:53 brd ff:ff:ff:ff:ff:ff
> > >     inet 192.168.0.1/24 brd 192.168.0.255 scope global eth0
> > > 7: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1514 qdisc
pfifo_fast qlen 3
> > >     link/ppp
> > >     inet 216.99.219.54 peer 208.130.244.122/32 scope global ppp0
> > >
> > >
> > > ip route show
> > > 208.130.244.122 dev ppp0  proto kernel  scope link  src
216.99.219.54
> > > 255.255.255.255 dev eth0  scope link
> > > 192.168.0.0/24 dev eth0  scope link
> > > 127.0.0.0/8 dev lo  scope link
> > > default via 208.130.244.122 dev ppp0
> > >
> > > Here''s the trace from where the masq file is searched
for:
> > >
> > > ++ find_file masq
> > > ++ ''['' -n '''' -a -f /masq
'']''
> > > ++ echo /etc/shorewall/masq
> > > + masq=/etc/shorewall/masq
> > > + ''['' -f /etc/shorewall/masq
'']''
> > > + setup_masq /etc/shorewall/masq
> > > + strip_file masq /etc/shorewall/masq
> > > + local fname
> > > + ''['' 2 = 1 '']''
> > > + fname=/etc/shorewall/masq
> > > + ''['' -f /etc/shorewall/masq
'']''
> > > + cut -d# -f1 /etc/shorewall/masq
> > > + grep -v ''^[[:space:]]*$''
> > > + ''['' -n Yes '']''
> > > + echo ''Masqueraded Subnets and Hosts:''
> > > + read fullinterface subnet address
> > > + expandv fullinterface subnet address
> > > + local varval
> > > + ''['' 3 -gt 0 '']''
> > > + eval ''varval=$fullinterface''
> > > ++ varval=ppp0
> > > + eval ''fullinterface="ppp0"''
> > > ++ fullinterface=ppp0
> > > + shift
> > > + ''['' 2 -gt 0 '']''
> > > + eval ''varval=$subnet''
> > > ++ varval=eth0
> > > + eval ''subnet="eth0"''
> > > ++ subnet=eth0
> > > + shift
> > > + ''['' 1 -gt 0 '']''
> > > + eval ''varval=$address''
> > > ++ varval> > > + eval
''address=""''
> > > ++ address> > > + shift
> > > + ''['' 0 -gt 0 '']''
> > > + ''['' -n Yes '']''
> > > + setup_one
> > > + local using
> > > + destnet=0.0.0.0/0
> > > + interface=ppp0
> > > + list_search ppp0 ppp0 eth0
> > > + local e=ppp0
> > > + ''['' 3 -gt 1 '']''
> > > + shift
> > > + ''['' xppp0 = xppp0 '']''
> > > + return 0
> > > + ''['' eth0 = eth0 '']''
> > > + nomasq> > > ++ masq_chain ppp0
> > > +++ chain_base ppp0
> > > +++ local c=ppp0
> > > +++ echo ppp0
> > > ++ echo ppp0_masq
> > > + chain=ppp0_masq
> > > + iface> > > + source=eth0
> > > ++ get_routed_subnets eth0
> > > ++ local address
> > > ++ local rest
> > > ++ ip route show dev eth0
> > > ++ read address rest
> > > ++ echo 255.255.255.255/32
> > > ++ read address rest
> > > ++ echo 192.168.0.0/24
> > > ++ read address rest
> > > + subnets=255.255.255.255/32
> > > 192.168.0.0/24
> > > + ''['' -z ''255.255.255.255/32
> > > 192.168.0.0/24'' '']''
> > > + subnet=255.255.255.255/32
> > > 192.168.0.0/24
> > > + ''['' -n '''' -a -n
'''' '']''
> > > + destination=0.0.0.0/0
> > > + ''['' -n ''''
'']''
> > > + destnet=-d 0.0.0.0/0
>
=== message truncated ==
__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software