[Shorewall-users] iptables: Invalid argument

Phil Tomson
Tue, 09 Sep 2003 17:36:42 -0000

Here''s what I''m seeing when I try to start shorewall:

[root@jed shorewall]# ../init.d/shorewall restart
Processing /etc/shorewall/params ...
Shorewall Not Currently Running
Starting Shorewall...
Loading Modules...
Initializing...
Determining Zones...
   Zones: net loc
Validating interfaces file...
Validating hosts file...
Validating Policy file...
Determining Hosts in Zones...
   Net Zone: ppp0:0.0.0.0/0
   Local Zone: eth0:0.0.0.0/0
Processing /etc/shorewall/init ...
Deleting user chains...
Creating input Chains...
Configuring Proxy ARP
Setting up NAT...
Adding Common Rules
Adding rules for DHCP
IP Forwarding Enabled
Processing /etc/shorewall/tunnels...
Processing /etc/shorewall/rules...
   Rule "ACCEPT fw net tcp 53" added.
   Rule "ACCEPT fw net udp 53" added.
   Rule "ACCEPT loc net tcp 53" added.
   Rule "ACCEPT loc net udp 53" added.
   Rule "ACCEPT loc fw tcp 22" added.
   Rule "ACCEPT loc net tcp 22" added.
   Rule "ACCEPT loc fw icmp 8" added.
   Rule "ACCEPT net fw icmp 8" added.
Processing /etc/shorewall/policy...
   Policy ACCEPT for fw to net using chain fw2net
   Policy ACCEPT for fw to loc using chain fw2loc
   Policy DROP for net to fw using chain net2all
   Policy ACCEPT for loc to fw using chain loc2all
   Policy ACCEPT for loc to net using chain loc2net
Masqueraded Subnets and Hosts:
iptables: Invalid argument
Processing /etc/shorewall/stop ...
Processing /etc/shorewall/stopped ...
Terminated


I noticed from the above that the something was wrong in the masq file, so
I removed it and then shorewall started OK (but masquerading doesn''t
work
because there''s no masq file).  My masq file only contains the
following:

#INTERFACE	        SUBNET		ADDRESS
ppp0                    eth0


...that''s it.  I connect to the internet via ppp0 and eth0 conntects to
the hub and two other computers.

shorewall version:
1.3.14a

uname -a
Linux jed.home.com 2.4.19-16mdk #1 Fri Sep 20 18:15:05 CEST 2002 i686

Mandrake 9.1 (with the older 2.4.19-16mdk kernel - the 2.4.21 kernel which
came with 9.1 caused my system to hang when accessing the CDROM, so I''m
using the older one - BTW: I was running shorewall on this machine/kernel
prior to the upgrade to 9.1, the kernel is identical to the one I used
with 9.0 which was running shorewall OK.)

ip addr show
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: e

th0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:d0:09:c4:3d:53 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.1/24 brd 192.168.0.255 scope global eth0
7: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1514 qdisc pfifo_fast qlen 3
    link/ppp
    inet 216.99.219.54 peer 208.130.244.122/32 scope global ppp0


ip route show
208.130.244.122 dev ppp0  proto kernel  scope link  src 216.99.219.54
255.255.255.255 dev eth0  scope link
192.168.0.0/24 dev eth0  scope link
127.0.0.0/8 dev lo  scope link
default via 208.130.244.122 dev ppp0

Here''s the trace from where the masq file is searched for:

++ find_file masq
++ ''['' -n '''' -a -f /masq
'']''
++ echo /etc/shorewall/masq
+ masq=/etc/shorewall/masq
+ ''['' -f /etc/shorewall/masq '']''
+ setup_masq /etc/shorewall/masq
+ strip_file masq /etc/shorewall/masq
+ local fname
+ ''['' 2 = 1 '']''
+ fname=/etc/shorewall/masq
+ ''['' -f /etc/shorewall/masq '']''
+ cut -d# -f1 /etc/shorewall/masq
+ grep -v ''^[[:space:]]*$''
+ ''['' -n Yes '']''
+ echo ''Masqueraded Subnets and Hosts:''
+ read fullinterface subnet address
+ expandv fullinterface subnet address
+ local varval
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$fullinterface''
++ varval=ppp0
+ eval ''fullinterface="ppp0"''
++ fullinterface=ppp0
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$subnet''
++ varval=eth0
+ eval ''subnet="eth0"''
++ subnet=eth0
+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$address''
++ varval+ eval ''address=""''
++ address+ shift
+ ''['' 0 -gt 0 '']''
+ ''['' -n Yes '']''
+ setup_one
+ local using
+ destnet=0.0.0.0/0
+ interface=ppp0
+ list_search ppp0 ppp0 eth0
+ local e=ppp0
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xppp0 = xppp0 '']''
+ return 0
+ ''['' eth0 = eth0 '']''
+ nomasq++ masq_chain ppp0
+++ chain_base ppp0
+++ local c=ppp0
+++ echo ppp0
++ echo ppp0_masq
+ chain=ppp0_masq
+ iface+ source=eth0
++ get_routed_subnets eth0
++ local address
++ local rest
++ ip route show dev eth0
++ read address rest
++ echo 255.255.255.255/32
++ read address rest
++ echo 192.168.0.0/24
++ read address rest
+ subnets=255.255.255.255/32
192.168.0.0/24
+ ''['' -z ''255.255.255.255/32
192.168.0.0/24'' '']''
+ subnet=255.255.255.255/32
192.168.0.0/24
+ ''['' -n '''' -a -n ''''
'']''
+ destination=0.0.0.0/0
+ ''['' -n '''' '']''
+ destnet=-d 0.0.0.0/0
+ ''['' -n ''255.255.255.255/32
192.168.0.0/24'' '']''
+ ''['' -n '''' '']''
+ addnatrule ppp0_masq -s 255.255.255.255/32 -d 0.0.0.0/0 -j MASQUERADE
+ ensurenatchain ppp0_masq
+ havenatchain ppp0_masq
+ eval test ''"$ppp0_masq_nat_exists"'' = Yes
++ test '''' = Yes
+ createnatchain ppp0_masq
+ run_iptables -t nat -N ppp0_masq
+ iptables -t nat -N ppp0_masq
+ eval ppp0_masq_nat_exists=Yes
++ ppp0_masq_nat_exists=Yes
+ run_iptables2 -t nat -A ppp0_masq -s 255.255.255.255/32 -d 0.0.0.0/0 -j
MASQUERADE
+ ''['' ''x-t nat -A ppp0_masq -s 255.255.255.255/32 -d
0.0.0.0/0 -j
MASQUERADE'' = ''x-t nat -A ppp0_masq -s 255.255.255.255/32 -d
0.0.0.0/0 -j
MASQUERADE'' '']''
+ run_iptables -t nat -A ppp0_masq -s 255.255.255.255/32 -d 0.0.0.0/0 -j
MASQUERADE
+ iptables -t nat -A ppp0_masq -s 255.255.255.255/32 -d 0.0.0.0/0 -j
MASQUERADE
iptables: Invalid argument
+ ''['' -z '''' '']''
+ stop_firewall
+ set +x

This is _not_ the version of shorewall that came with Mandrake (I heeded
the instructions in the quick start which said to remove Mandrake''s
shorewall package and install one from the shorewall site).

Phil