[Shorewall-users] iptables: Invalid argument (found problem)

David T Hollis
Wed, 10 Sep 2003 14:14:49 -0000

Phil Tomson wrote:

>OK, I went to try it all manually with iptables and got hte same thing, so
>then I decided to reboot into the 2.4.21mdk kernel that came
>with Mandrake 9.1 (carefully avoiding accessing the CDROM since that kernal
>hangs when I access the CDROM.).  After doing that the Invalid argument
>message went away when starting shorewall.  I suspect that the iptables
>must match the kernel or perhaps the modules being loaded were wrong...
>
>So now I''ve got a different problem - gotta figure out whey the
CDROM
>access hangs the system.. but that''s a problem for a different
mailing
>list ;-)  Thanks for  the help.
>
>Phil
>
>On Wed, 10 Sep 2003, Eduardo Ferreira wrote:
>
>
>
>>man, I''m out of ideas.  had you already tried the last version
1.4.6c? or
>>any other than that you are using?
>>
>>
>>
>>
>>
>>Phil Tomson <ptkwt@aracnet.com>
>>Sent by: shorewall-users-bounces@lists.shorewall.net
>>10/09/2003 15:56
>>Please respond to
>>Shorewall Users Mailing List <shorewall-users@lists.shorewall.net>
>>
>>
>>To
>>Shorewall Users Mailing List <shorewall-users@lists.shorewall.net>
>>cc
>>
>>Subject
>>Re: [Shorewall-users] iptables: Invalid argument
>>
>>
>>
>>
>>
>>
>>
>>
>>Just tried replacing the ''detect'' with
''-'' for the net ppp0 entry of my
>>interfaces file and it doidin''t help... the problem persists.
>>
>>
>>Phil
>>On Wed, 10 Sep 2003, Eduardo Ferreira wrote:
>>
>>
>>
>>>me thinks it depends on the type of service you get.  I use a ADSL
>>>connection via ppp0 and in my shorewall interfaces file I read:
>>>
>>>net     ppp0    -       norfc1918,dhcp,routefilter,tcpflags
>>>
>>>I use ''-'' instead of ''detect'' in
the broadcast column following the
>>>guidelines of the interface files (and the 3rd example in the same
>>>
>>>
>>file).
>>
>>
>>>works here...
>>>
>>>HIH,
>>>
>>>Eduardo Ferreira
>>>
>>>
>>>
>>>
>>>
>>>Phil Tomson <ptkwt@aracnet.com>
>>>Sent by: shorewall-users-bounces@lists.shorewall.net
>>>10/09/2003 14:40
>>>Please respond to
>>>Shorewall Users Mailing List
<shorewall-users@lists.shorewall.net>
>>>
>>>
>>>To
>>>Shorewall Users Mailing List
<shorewall-users@lists.shorewall.net>
>>>cc
>>>
>>>Subject
>>>Re: [Shorewall-users] iptables: Invalid argument
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>On 10 Sep 2003, Ed Greshko wrote:
>>>
>>>
>>>
>>>>On Wed, 2003-09-10 at 16:11, Phil Tomson wrote:
>>>>
>>>>
>>>>> just tried the uninstall-reinstall idea.  Problem still
exists.
>>>>>
>>>>>The offending iptables command is this (from the trace):
>>>>>iptables -t nat -A ppp0_masq -s 255.255.255.255/32 -d
0.0.0.0/0 -j
>>>>>MASQUERADE
>>>>>
>>>>>
>>>>The command you cite above looks rather odd to me....
>>>>
>>>>On my system I see the following...
>>>>
>>>>iptables -t nat -A eth0_masq -s 192.168.1.0/24 -d 0.0.0.0/0 -j
>>>>
>>>>
>>>MASQUERADE
>>>
>>>
>>>>where 192.168.1.0/24 is the network address of eth1...
>>>>
>>>>
>>>>
>>>Hmmmm.... I thought the  255.255.255.255 was a bit odd.
>>>
>>>Any idea how that number is determined?
>>>
>>>Phil
>>>
>>>_______________________________________________
>>>Shorewall-users mailing list
>>>Post: Shorewall-users@lists.shorewall.net
>>>Subscribe/Unsubscribe:
>>>http://lists.shorewall.net/mailman/listinfo/shorewall-users
>>>Support: http://www.shorewall.net/support.htm
>>>FAQ: http://www.shorewall.net/FAQ.htm
>>>
>>>_______________________________________________
>>>Shorewall-users mailing list
>>>Post: Shorewall-users@lists.shorewall.net
>>>Subscribe/Unsubscribe:
>>>
>>>
>>http://lists.shorewall.net/mailman/listinfo/shorewall-users
>>
>>
>>>Support: http://www.shorewall.net/support.htm
>>>FAQ: http://www.shorewall.net/FAQ.htm
>>>
>>>
>>>
>>_______________________________________________
>>Shorewall-users mailing list
>>Post: Shorewall-users@lists.shorewall.net
>>Subscribe/Unsubscribe:
>>http://lists.shorewall.net/mailman/listinfo/shorewall-users
>>Support: http://www.shorewall.net/support.htm
>>FAQ: http://www.shorewall.net/FAQ.htm
>>
>>_______________________________________________
>>Shorewall-users mailing list
>>Post: Shorewall-users@lists.shorewall.net
>>Subscribe/Unsubscribe:
http://lists.shorewall.net/mailman/listinfo/shorewall-users
>>Support: http://www.shorewall.net/support.htm
>>FAQ: http://www.shorewall.net/FAQ.htm
>>
>>
>>
>
>_______________________________________________
>Shorewall-users mailing list
>Post: Shorewall-users@lists.shorewall.net
>Subscribe/Unsubscribe:
http://lists.shorewall.net/mailman/listinfo/shorewall-users
>Support: http://www.shorewall.net/support.htm
>FAQ: http://www.shorewall.net/FAQ.htm
>
>
I could have saved you a few hours of debugging had I checked the list
earlier ;).  I had this problem a week or so ago when I setup a Gentoo
system with Shorewall.  When I installed iptables, it compiled against
the Gentoo kernel headers which had some additional patches to netfilter
etc.  I wound up running with a hand made kernel to meet my requirements
and I had a lot of hair pulling with that.  After I rebuild iptables
against my kernel headers, everything was fine.