[Shorewall-users] iptables: Invalid argument

Phil Tomson
Tue, 09 Sep 2003 22:51:02 -0000

I was starting shorewall _after_ ppp0 was up.

Phil

On Tue, 9 Sep 2003, Jerry Vonau wrote:

> Phil:
>
> You are starting shorewall before the interface is up...
> use the /etc/ppp/ip-up.local file to (re)start shorewall
>
> see:
> http://www.shorewall.net/starting_and_stopping_shorewall.htm
> Important Notes: 2
>
> Jerry Vonau
>
>
>
>
>
> ----- Original Message -----
> From: "Phil Tomson" <ptkwt@aracnet.com>
> To: <shorewall-users@lists.shorewall.net>
> Sent: Tuesday, September 09, 2003 07:35 PM
> Subject: [Shorewall-users] iptables: Invalid argument
>
>
> >
> > Here''s what I''m seeing when I try to start
shorewall:
> >
> > [root@jed shorewall]# ../init.d/shorewall restart
> > Processing /etc/shorewall/params ...
> > Shorewall Not Currently Running
> > Starting Shorewall...
> > Loading Modules...
> > Initializing...
> > Determining Zones...
> >    Zones: net loc
> > Validating interfaces file...
> > Validating hosts file...
> > Validating Policy file...
> > Determining Hosts in Zones...
> >    Net Zone: ppp0:0.0.0.0/0
> >    Local Zone: eth0:0.0.0.0/0
> > Processing /etc/shorewall/init ...
> > Deleting user chains...
> > Creating input Chains...
> > Configuring Proxy ARP
> > Setting up NAT...
> > Adding Common Rules
> > Adding rules for DHCP
> > IP Forwarding Enabled
> > Processing /etc/shorewall/tunnels...
> > Processing /etc/shorewall/rules...
> >    Rule "ACCEPT fw net tcp 53" added.
> >    Rule "ACCEPT fw net udp 53" added.
> >    Rule "ACCEPT loc net tcp 53" added.
> >    Rule "ACCEPT loc net udp 53" added.
> >    Rule "ACCEPT loc fw tcp 22" added.
> >    Rule "ACCEPT loc net tcp 22" added.
> >    Rule "ACCEPT loc fw icmp 8" added.
> >    Rule "ACCEPT net fw icmp 8" added.
> > Processing /etc/shorewall/policy...
> >    Policy ACCEPT for fw to net using chain fw2net
> >    Policy ACCEPT for fw to loc using chain fw2loc
> >    Policy DROP for net to fw using chain net2all
> >    Policy ACCEPT for loc to fw using chain loc2all
> >    Policy ACCEPT for loc to net using chain loc2net
> > Masqueraded Subnets and Hosts:
> > iptables: Invalid argument
> > Processing /etc/shorewall/stop ...
> > Processing /etc/shorewall/stopped ...
> > Terminated
> >
> >
> > I noticed from the above that the something was wrong in the masq
file, so
> > I removed it and then shorewall started OK (but masquerading
doesn''t work
> > because there''s no masq file).  My masq file only contains
the following:
> >
> > #INTERFACE         SUBNET ADDRESS
> > ppp0                    eth0
> >
> >
> > ...that''s it.  I connect to the internet via ppp0 and eth0
conntects to
> > the hub and two other computers.
> >
> > shorewall version:
> > 1.3.14a
> >
> > uname -a
> > Linux jed.home.com 2.4.19-16mdk #1 Fri Sep 20 18:15:05 CEST 2002 i686
> >
> > Mandrake 9.1 (with the older 2.4.19-16mdk kernel - the 2.4.21 kernel
which
> > came with 9.1 caused my system to hang when accessing the CDROM, so
I''m
> > using the older one - BTW: I was running shorewall on this
machine/kernel
> > prior to the upgrade to 9.1, the kernel is identical to the one I used
> > with 9.0 which was running shorewall OK.)
> >
> > ip addr show
> > 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
> >     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
> >     inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
> > 2: e
> >
> > th0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
> >     link/ether 00:d0:09:c4:3d:53 brd ff:ff:ff:ff:ff:ff
> >     inet 192.168.0.1/24 brd 192.168.0.255 scope global eth0
> > 7: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1514 qdisc
pfifo_fast qlen 3
> >     link/ppp
> >     inet 216.99.219.54 peer 208.130.244.122/32 scope global ppp0
> >
> >
> > ip route show
> > 208.130.244.122 dev ppp0  proto kernel  scope link  src 216.99.219.54
> > 255.255.255.255 dev eth0  scope link
> > 192.168.0.0/24 dev eth0  scope link
> > 127.0.0.0/8 dev lo  scope link
> > default via 208.130.244.122 dev ppp0
> >
> > Here''s the trace from where the masq file is searched for:
> >
> > ++ find_file masq
> > ++ ''['' -n '''' -a -f /masq
'']''
> > ++ echo /etc/shorewall/masq
> > + masq=/etc/shorewall/masq
> > + ''['' -f /etc/shorewall/masq '']''
> > + setup_masq /etc/shorewall/masq
> > + strip_file masq /etc/shorewall/masq
> > + local fname
> > + ''['' 2 = 1 '']''
> > + fname=/etc/shorewall/masq
> > + ''['' -f /etc/shorewall/masq '']''
> > + cut -d# -f1 /etc/shorewall/masq
> > + grep -v ''^[[:space:]]*$''
> > + ''['' -n Yes '']''
> > + echo ''Masqueraded Subnets and Hosts:''
> > + read fullinterface subnet address
> > + expandv fullinterface subnet address
> > + local varval
> > + ''['' 3 -gt 0 '']''
> > + eval ''varval=$fullinterface''
> > ++ varval=ppp0
> > + eval ''fullinterface="ppp0"''
> > ++ fullinterface=ppp0
> > + shift
> > + ''['' 2 -gt 0 '']''
> > + eval ''varval=$subnet''
> > ++ varval=eth0
> > + eval ''subnet="eth0"''
> > ++ subnet=eth0
> > + shift
> > + ''['' 1 -gt 0 '']''
> > + eval ''varval=$address''
> > ++ varval> > + eval ''address=""''
> > ++ address> > + shift
> > + ''['' 0 -gt 0 '']''
> > + ''['' -n Yes '']''
> > + setup_one
> > + local using
> > + destnet=0.0.0.0/0
> > + interface=ppp0
> > + list_search ppp0 ppp0 eth0
> > + local e=ppp0
> > + ''['' 3 -gt 1 '']''
> > + shift
> > + ''['' xppp0 = xppp0 '']''
> > + return 0
> > + ''['' eth0 = eth0 '']''
> > + nomasq> > ++ masq_chain ppp0
> > +++ chain_base ppp0
> > +++ local c=ppp0
> > +++ echo ppp0
> > ++ echo ppp0_masq
> > + chain=ppp0_masq
> > + iface> > + source=eth0
> > ++ get_routed_subnets eth0
> > ++ local address
> > ++ local rest
> > ++ ip route show dev eth0
> > ++ read address rest
> > ++ echo 255.255.255.255/32
> > ++ read address rest
> > ++ echo 192.168.0.0/24
> > ++ read address rest
> > + subnets=255.255.255.255/32
> > 192.168.0.0/24
> > + ''['' -z ''255.255.255.255/32
> > 192.168.0.0/24'' '']''
> > + subnet=255.255.255.255/32
> > 192.168.0.0/24
> > + ''['' -n '''' -a -n
'''' '']''
> > + destination=0.0.0.0/0
> > + ''['' -n '''' '']''
> > + destnet=-d 0.0.0.0/0
> > + ''['' -n ''255.255.255.255/32
> > 192.168.0.0/24'' '']''
> > + ''['' -n '''' '']''
> > + addnatrule ppp0_masq -s 255.255.255.255/32 -d 0.0.0.0/0 -j
MASQUERADE
> > + ensurenatchain ppp0_masq
> > + havenatchain ppp0_masq
> > + eval test ''"$ppp0_masq_nat_exists"'' =
Yes
> > ++ test '''' = Yes
> > + createnatchain ppp0_masq
> > + run_iptables -t nat -N ppp0_masq
> > + iptables -t nat -N ppp0_masq
> > + eval ppp0_masq_nat_exists=Yes
> > ++ ppp0_masq_nat_exists=Yes
> > + run_iptables2 -t nat -A ppp0_masq -s 255.255.255.255/32 -d 0.0.0.0/0
-j
> > MASQUERADE
> > + ''['' ''x-t nat -A ppp0_masq -s
255.255.255.255/32 -d 0.0.0.0/0 -j
> > MASQUERADE'' = ''x-t nat -A ppp0_masq -s
255.255.255.255/32 -d 0.0.0.0/0 -j
> > MASQUERADE'' '']''
> > + run_iptables -t nat -A ppp0_masq -s 255.255.255.255/32 -d 0.0.0.0/0
-j
> > MASQUERADE
> > + iptables -t nat -A ppp0_masq -s 255.255.255.255/32 -d 0.0.0.0/0 -j
> > MASQUERADE
> > iptables: Invalid argument
> > + ''['' -z '''' '']''
> > + stop_firewall
> > + set +x
> >
> > This is _not_ the version of shorewall that came with Mandrake (I
heeded
> > the instructions in the quick start which said to remove
Mandrake''s
> > shorewall package and install one from the shorewall site).
> >
> > Phil
> >
> >
> > _______________________________________________
> > Shorewall-users mailing list
> > Post: Shorewall-users@lists.shorewall.net
> > Subscribe/Unsubscribe:
> http://lists.shorewall.net/mailman/listinfo/shorewall-users
> > Support: http://www.shorewall.net/support.htm
> > FAQ: http://www.shorewall.net/FAQ.htm
>
> _______________________________________________
> Shorewall-users mailing list
> Post: Shorewall-users@lists.shorewall.net
> Subscribe/Unsubscribe:
http://lists.shorewall.net/mailman/listinfo/shorewall-users
> Support: http://www.shorewall.net/support.htm
> FAQ: http://www.shorewall.net/FAQ.htm
>