[Shorewall-users] iptables: Invalid argument

Phil Tomson
Wed, 10 Sep 2003 01:07:20 -0000

On 10 Sep 2003, Ed Greshko wrote:

> On Wed, 2003-09-10 at 13:50, Phil Tomson wrote:
> > I was starting shorewall _after_ ppp0 was up.
> >
>
> Just for fun, could you post the output of "lsmod"/

Sure, here it is:

[root@jed shorewall]# lsmod
Module                  Size  Used by    Not tainted
nls_iso8859-1           2844   1  (autoclean)
isofs                  25652   1  (autoclean)
inflate_fs             17892   0  (autoclean) [isofs]
ipt_LOG                 3384   5  (autoclean)
ipt_TOS                  984  12  (autoclean)
ipt_MASQUERADE          1272   0  (autoclean)
ipt_REJECT              2744   4  (autoclean)
ipt_TCPMSS              2360   1  (autoclean)
ipt_state                568  16  (autoclean)
iptable_mangle          2072   1  (autoclean)
ip_nat_irc              2384   0  (unused)
ip_nat_ftp              2992   0  (unused)
iptable_nat            15224   2  [ipt_MASQUERADE ip_nat_irc ip_nat_ftp]
ip_conntrack_irc        3056   1
ip_conntrack_ftp        3952   1
ip_conntrack           18400   4  [ipt_MASQUERADE ipt_state ip_nat_irc
ip_nat_ftp iptable_nat ip_conntrack_irc ip_conntrack_ftp]
iptable_filter          1644   1  (autoclean)
ip_tables              11672  11  [ipt_LOG ipt_TOS ipt_MASQUERADE
ipt_REJECT ipt_TCPMSS ipt_state iptable_mangle iptable_nat iptable_filter]
ppp_deflate            41024   0  (autoclean)
bsd_comp                4344   0  (autoclean)
lp                      6720   0  (autoclean) (unused)
parport                23936   0  (autoclean) [lp]
nfsd                   66576   8  (autoclean)
lockd                  46480   1  (autoclean) [nfsd]
sunrpc                 60188   1  (autoclean) [nfsd lockd]
ppp_async               7456   1
ppp_generic            20064   3  [ppp_deflate bsd_comp ppp_async]
slhc                    5072   1  [ppp_generic]
af_packet              13000   1  (autoclean)
sr_mod                 15096   2  (autoclean)
floppy                 49340   0
sis900                 13388   1  (autoclean)
supermount             14340   2  (autoclean)
ide-cd                 28712   0
cdrom                  26848   0  [sr_mod ide-cd]
ide-scsi                8212   1
scsi_mod               90372   2  [sr_mod ide-scsi]
rtc                     6560   0  (autoclean)
ext3                   74004   6
jbd                    38452   6  [ext3]


>
>
> >
> > On Tue, 9 Sep 2003, Jerry Vonau wrote:
> >
> > > Phil:
> > >
> > > You are starting shorewall before the interface is up...
> > > use the /etc/ppp/ip-up.local file to (re)start shorewall
> > >
> > > see:
> > > http://www.shorewall.net/starting_and_stopping_shorewall.htm
> > > Important Notes: 2
> > >
> > > Jerry Vonau
> > >
> > >
> > >
> > >
> > >
> > > ----- Original Message -----
> > > From: "Phil Tomson" <ptkwt@aracnet.com>
> > > To: <shorewall-users@lists.shorewall.net>
> > > Sent: Tuesday, September 09, 2003 07:35 PM
> > > Subject: [Shorewall-users] iptables: Invalid argument
> > >
> > >
> > > >
> > > > Here''s what I''m seeing when I try to start
shorewall:
> > > >
> > > > [root@jed shorewall]# ../init.d/shorewall restart
> > > > Processing /etc/shorewall/params ...
> > > > Shorewall Not Currently Running
> > > > Starting Shorewall...
> > > > Loading Modules...
> > > > Initializing...
> > > > Determining Zones...
> > > >    Zones: net loc
> > > > Validating interfaces file...
> > > > Validating hosts file...
> > > > Validating Policy file...
> > > > Determining Hosts in Zones...
> > > >    Net Zone: ppp0:0.0.0.0/0
> > > >    Local Zone: eth0:0.0.0.0/0
> > > > Processing /etc/shorewall/init ...
> > > > Deleting user chains...
> > > > Creating input Chains...
> > > > Configuring Proxy ARP
> > > > Setting up NAT...
> > > > Adding Common Rules
> > > > Adding rules for DHCP
> > > > IP Forwarding Enabled
> > > > Processing /etc/shorewall/tunnels...
> > > > Processing /etc/shorewall/rules...
> > > >    Rule "ACCEPT fw net tcp 53" added.
> > > >    Rule "ACCEPT fw net udp 53" added.
> > > >    Rule "ACCEPT loc net tcp 53" added.
> > > >    Rule "ACCEPT loc net udp 53" added.
> > > >    Rule "ACCEPT loc fw tcp 22" added.
> > > >    Rule "ACCEPT loc net tcp 22" added.
> > > >    Rule "ACCEPT loc fw icmp 8" added.
> > > >    Rule "ACCEPT net fw icmp 8" added.
> > > > Processing /etc/shorewall/policy...
> > > >    Policy ACCEPT for fw to net using chain fw2net
> > > >    Policy ACCEPT for fw to loc using chain fw2loc
> > > >    Policy DROP for net to fw using chain net2all
> > > >    Policy ACCEPT for loc to fw using chain loc2all
> > > >    Policy ACCEPT for loc to net using chain loc2net
> > > > Masqueraded Subnets and Hosts:
> > > > iptables: Invalid argument
> > > > Processing /etc/shorewall/stop ...
> > > > Processing /etc/shorewall/stopped ...
> > > > Terminated
> > > >
> > > >
> > > > I noticed from the above that the something was wrong in the
masq file, so
> > > > I removed it and then shorewall started OK (but masquerading
doesn''t work
> > > > because there''s no masq file).  My masq file only
contains the following:
> > > >
> > > > #INTERFACE         SUBNET ADDRESS
> > > > ppp0                    eth0
> > > >
> > > >
> > > > ...that''s it.  I connect to the internet via ppp0
and eth0 conntects to
> > > > the hub and two other computers.
> > > >
> > > > shorewall version:
> > > > 1.3.14a
> > > >
> > > > uname -a
> > > > Linux jed.home.com 2.4.19-16mdk #1 Fri Sep 20 18:15:05 CEST
2002 i686
> > > >
> > > > Mandrake 9.1 (with the older 2.4.19-16mdk kernel - the
2.4.21 kernel which
> > > > came with 9.1 caused my system to hang when accessing the
CDROM, so I''m
> > > > using the older one - BTW: I was running shorewall on this
machine/kernel
> > > > prior to the upgrade to 9.1, the kernel is identical to the
one I used
> > > > with 9.0 which was running shorewall OK.)
> > > >
> > > > ip addr show
> > > > 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
> > > >     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
> > > >     inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
> > > > 2: e
> > > >
> > > > th0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc
pfifo_fast qlen 100
> > > >     link/ether 00:d0:09:c4:3d:53 brd ff:ff:ff:ff:ff:ff
> > > >     inet 192.168.0.1/24 brd 192.168.0.255 scope global eth0
> > > > 7: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1514
qdisc pfifo_fast qlen 3
> > > >     link/ppp
> > > >     inet 216.99.219.54 peer 208.130.244.122/32 scope global
ppp0
> > > >
> > > >
> > > > ip route show
> > > > 208.130.244.122 dev ppp0  proto kernel  scope link  src
216.99.219.54
> > > > 255.255.255.255 dev eth0  scope link
> > > > 192.168.0.0/24 dev eth0  scope link
> > > > 127.0.0.0/8 dev lo  scope link
> > > > default via 208.130.244.122 dev ppp0
> > > >
> > > > Here''s the trace from where the masq file is
searched for:
> > > >
> > > > ++ find_file masq
> > > > ++ ''['' -n '''' -a -f /masq
'']''
> > > > ++ echo /etc/shorewall/masq
> > > > + masq=/etc/shorewall/masq
> > > > + ''['' -f /etc/shorewall/masq
'']''
> > > > + setup_masq /etc/shorewall/masq
> > > > + strip_file masq /etc/shorewall/masq
> > > > + local fname
> > > > + ''['' 2 = 1 '']''
> > > > + fname=/etc/shorewall/masq
> > > > + ''['' -f /etc/shorewall/masq
'']''
> > > > + cut -d# -f1 /etc/shorewall/masq
> > > > + grep -v ''^[[:space:]]*$''
> > > > + ''['' -n Yes '']''
> > > > + echo ''Masqueraded Subnets and Hosts:''
> > > > + read fullinterface subnet address
> > > > + expandv fullinterface subnet address
> > > > + local varval
> > > > + ''['' 3 -gt 0 '']''
> > > > + eval ''varval=$fullinterface''
> > > > ++ varval=ppp0
> > > > + eval ''fullinterface="ppp0"''
> > > > ++ fullinterface=ppp0
> > > > + shift
> > > > + ''['' 2 -gt 0 '']''
> > > > + eval ''varval=$subnet''
> > > > ++ varval=eth0
> > > > + eval ''subnet="eth0"''
> > > > ++ subnet=eth0
> > > > + shift
> > > > + ''['' 1 -gt 0 '']''
> > > > + eval ''varval=$address''
> > > > ++ varval> > > > + eval
''address=""''
> > > > ++ address> > > > + shift
> > > > + ''['' 0 -gt 0 '']''
> > > > + ''['' -n Yes '']''
> > > > + setup_one
> > > > + local using
> > > > + destnet=0.0.0.0/0
> > > > + interface=ppp0
> > > > + list_search ppp0 ppp0 eth0
> > > > + local e=ppp0
> > > > + ''['' 3 -gt 1 '']''
> > > > + shift
> > > > + ''['' xppp0 = xppp0 '']''
> > > > + return 0
> > > > + ''['' eth0 = eth0 '']''
> > > > + nomasq> > > > ++ masq_chain ppp0
> > > > +++ chain_base ppp0
> > > > +++ local c=ppp0
> > > > +++ echo ppp0
> > > > ++ echo ppp0_masq
> > > > + chain=ppp0_masq
> > > > + iface> > > > + source=eth0
> > > > ++ get_routed_subnets eth0
> > > > ++ local address
> > > > ++ local rest
> > > > ++ ip route show dev eth0
> > > > ++ read address rest
> > > > ++ echo 255.255.255.255/32
> > > > ++ read address rest
> > > > ++ echo 192.168.0.0/24
> > > > ++ read address rest
> > > > + subnets=255.255.255.255/32
> > > > 192.168.0.0/24
> > > > + ''['' -z ''255.255.255.255/32
> > > > 192.168.0.0/24'' '']''
> > > > + subnet=255.255.255.255/32
> > > > 192.168.0.0/24
> > > > + ''['' -n '''' -a -n
'''' '']''
> > > > + destination=0.0.0.0/0
> > > > + ''['' -n ''''
'']''
> > > > + destnet=-d 0.0.0.0/0
> > > > + ''['' -n ''255.255.255.255/32
> > > > 192.168.0.0/24'' '']''
> > > > + ''['' -n ''''
'']''
> > > > + addnatrule ppp0_masq -s 255.255.255.255/32 -d 0.0.0.0/0 -j
MASQUERADE
> > > > + ensurenatchain ppp0_masq
> > > > + havenatchain ppp0_masq
> > > > + eval test
''"$ppp0_masq_nat_exists"'' = Yes
> > > > ++ test '''' = Yes
> > > > + createnatchain ppp0_masq
> > > > + run_iptables -t nat -N ppp0_masq
> > > > + iptables -t nat -N ppp0_masq
> > > > + eval ppp0_masq_nat_exists=Yes
> > > > ++ ppp0_masq_nat_exists=Yes
> > > > + run_iptables2 -t nat -A ppp0_masq -s 255.255.255.255/32 -d
0.0.0.0/0 -j
> > > > MASQUERADE
> > > > + ''['' ''x-t nat -A ppp0_masq -s
255.255.255.255/32 -d 0.0.0.0/0 -j
> > > > MASQUERADE'' = ''x-t nat -A ppp0_masq -s
255.255.255.255/32 -d 0.0.0.0/0 -j
> > > > MASQUERADE'' '']''
> > > > + run_iptables -t nat -A ppp0_masq -s 255.255.255.255/32 -d
0.0.0.0/0 -j
> > > > MASQUERADE
> > > > + iptables -t nat -A ppp0_masq -s 255.255.255.255/32 -d
0.0.0.0/0 -j
> > > > MASQUERADE
> > > > iptables: Invalid argument
> > > > + ''['' -z ''''
'']''
> > > > + stop_firewall
> > > > + set +x
> > > >
> > > > This is _not_ the version of shorewall that came with
Mandrake (I heeded
> > > > the instructions in the quick start which said to remove
Mandrake''s
> > > > shorewall package and install one from the shorewall site).
> > > >
> > > > Phil
> > > >
> > > >
> > > > _______________________________________________
> > > > Shorewall-users mailing list
> > > > Post: Shorewall-users@lists.shorewall.net
> > > > Subscribe/Unsubscribe:
> > > http://lists.shorewall.net/mailman/listinfo/shorewall-users
> > > > Support: http://www.shorewall.net/support.htm
> > > > FAQ: http://www.shorewall.net/FAQ.htm
> > >
> > > _______________________________________________
> > > Shorewall-users mailing list
> > > Post: Shorewall-users@lists.shorewall.net
> > > Subscribe/Unsubscribe:
http://lists.shorewall.net/mailman/listinfo/shorewall-users
> > > Support: http://www.shorewall.net/support.htm
> > > FAQ: http://www.shorewall.net/FAQ.htm
> > >
> >
> > _______________________________________________
> > Shorewall-users mailing list
> > Post: Shorewall-users@lists.shorewall.net
> > Subscribe/Unsubscribe:
http://lists.shorewall.net/mailman/listinfo/shorewall-users
> > Support: http://www.shorewall.net/support.htm
> > FAQ: http://www.shorewall.net/FAQ.htm
> --
> http://www.shorewall.net       Shorewall, for all your firewall needs
>
> _______________________________________________
> Shorewall-users mailing list
> Post: Shorewall-users@lists.shorewall.net
> Subscribe/Unsubscribe:
http://lists.shorewall.net/mailman/listinfo/shorewall-users
> Support: http://www.shorewall.net/support.htm
> FAQ: http://www.shorewall.net/FAQ.htm
>