[Shorewall-users] iptables: Invalid argument

Jerry Vonau
Tue, 09 Sep 2003 19:39:39 -0000

Phil:

You are starting shorewall before the interface is up...
use the /etc/ppp/ip-up.local file to (re)start shorewall

see:
http://www.shorewall.net/starting_and_stopping_shorewall.htm
Important Notes: 2

Jerry Vonau





----- Original Message -----
From: "Phil Tomson" <ptkwt@aracnet.com>
To: <shorewall-users@lists.shorewall.net>
Sent: Tuesday, September 09, 2003 07:35 PM
Subject: [Shorewall-users] iptables: Invalid argument


>
> Here''s what I''m seeing when I try to start shorewall:
>
> [root@jed shorewall]# ../init.d/shorewall restart
> Processing /etc/shorewall/params ...
> Shorewall Not Currently Running
> Starting Shorewall...
> Loading Modules...
> Initializing...
> Determining Zones...
>    Zones: net loc
> Validating interfaces file...
> Validating hosts file...
> Validating Policy file...
> Determining Hosts in Zones...
>    Net Zone: ppp0:0.0.0.0/0
>    Local Zone: eth0:0.0.0.0/0
> Processing /etc/shorewall/init ...
> Deleting user chains...
> Creating input Chains...
> Configuring Proxy ARP
> Setting up NAT...
> Adding Common Rules
> Adding rules for DHCP
> IP Forwarding Enabled
> Processing /etc/shorewall/tunnels...
> Processing /etc/shorewall/rules...
>    Rule "ACCEPT fw net tcp 53" added.
>    Rule "ACCEPT fw net udp 53" added.
>    Rule "ACCEPT loc net tcp 53" added.
>    Rule "ACCEPT loc net udp 53" added.
>    Rule "ACCEPT loc fw tcp 22" added.
>    Rule "ACCEPT loc net tcp 22" added.
>    Rule "ACCEPT loc fw icmp 8" added.
>    Rule "ACCEPT net fw icmp 8" added.
> Processing /etc/shorewall/policy...
>    Policy ACCEPT for fw to net using chain fw2net
>    Policy ACCEPT for fw to loc using chain fw2loc
>    Policy DROP for net to fw using chain net2all
>    Policy ACCEPT for loc to fw using chain loc2all
>    Policy ACCEPT for loc to net using chain loc2net
> Masqueraded Subnets and Hosts:
> iptables: Invalid argument
> Processing /etc/shorewall/stop ...
> Processing /etc/shorewall/stopped ...
> Terminated
>
>
> I noticed from the above that the something was wrong in the masq file, so
> I removed it and then shorewall started OK (but masquerading
doesn''t work
> because there''s no masq file).  My masq file only contains the
following:
>
> #INTERFACE         SUBNET ADDRESS
> ppp0                    eth0
>
>
> ...that''s it.  I connect to the internet via ppp0 and eth0
conntects to
> the hub and two other computers.
>
> shorewall version:
> 1.3.14a
>
> uname -a
> Linux jed.home.com 2.4.19-16mdk #1 Fri Sep 20 18:15:05 CEST 2002 i686
>
> Mandrake 9.1 (with the older 2.4.19-16mdk kernel - the 2.4.21 kernel which
> came with 9.1 caused my system to hang when accessing the CDROM, so
I''m
> using the older one - BTW: I was running shorewall on this machine/kernel
> prior to the upgrade to 9.1, the kernel is identical to the one I used
> with 9.0 which was running shorewall OK.)
>
> ip addr show
> 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
>     inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
> 2: e
>
> th0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
>     link/ether 00:d0:09:c4:3d:53 brd ff:ff:ff:ff:ff:ff
>     inet 192.168.0.1/24 brd 192.168.0.255 scope global eth0
> 7: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1514 qdisc pfifo_fast
qlen 3
>     link/ppp
>     inet 216.99.219.54 peer 208.130.244.122/32 scope global ppp0
>
>
> ip route show
> 208.130.244.122 dev ppp0  proto kernel  scope link  src 216.99.219.54
> 255.255.255.255 dev eth0  scope link
> 192.168.0.0/24 dev eth0  scope link
> 127.0.0.0/8 dev lo  scope link
> default via 208.130.244.122 dev ppp0
>
> Here''s the trace from where the masq file is searched for:
>
> ++ find_file masq
> ++ ''['' -n '''' -a -f /masq
'']''
> ++ echo /etc/shorewall/masq
> + masq=/etc/shorewall/masq
> + ''['' -f /etc/shorewall/masq '']''
> + setup_masq /etc/shorewall/masq
> + strip_file masq /etc/shorewall/masq
> + local fname
> + ''['' 2 = 1 '']''
> + fname=/etc/shorewall/masq
> + ''['' -f /etc/shorewall/masq '']''
> + cut -d# -f1 /etc/shorewall/masq
> + grep -v ''^[[:space:]]*$''
> + ''['' -n Yes '']''
> + echo ''Masqueraded Subnets and Hosts:''
> + read fullinterface subnet address
> + expandv fullinterface subnet address
> + local varval
> + ''['' 3 -gt 0 '']''
> + eval ''varval=$fullinterface''
> ++ varval=ppp0
> + eval ''fullinterface="ppp0"''
> ++ fullinterface=ppp0
> + shift
> + ''['' 2 -gt 0 '']''
> + eval ''varval=$subnet''
> ++ varval=eth0
> + eval ''subnet="eth0"''
> ++ subnet=eth0
> + shift
> + ''['' 1 -gt 0 '']''
> + eval ''varval=$address''
> ++ varval> + eval ''address=""''
> ++ address> + shift
> + ''['' 0 -gt 0 '']''
> + ''['' -n Yes '']''
> + setup_one
> + local using
> + destnet=0.0.0.0/0
> + interface=ppp0
> + list_search ppp0 ppp0 eth0
> + local e=ppp0
> + ''['' 3 -gt 1 '']''
> + shift
> + ''['' xppp0 = xppp0 '']''
> + return 0
> + ''['' eth0 = eth0 '']''
> + nomasq> ++ masq_chain ppp0
> +++ chain_base ppp0
> +++ local c=ppp0
> +++ echo ppp0
> ++ echo ppp0_masq
> + chain=ppp0_masq
> + iface> + source=eth0
> ++ get_routed_subnets eth0
> ++ local address
> ++ local rest
> ++ ip route show dev eth0
> ++ read address rest
> ++ echo 255.255.255.255/32
> ++ read address rest
> ++ echo 192.168.0.0/24
> ++ read address rest
> + subnets=255.255.255.255/32
> 192.168.0.0/24
> + ''['' -z ''255.255.255.255/32
> 192.168.0.0/24'' '']''
> + subnet=255.255.255.255/32
> 192.168.0.0/24
> + ''['' -n '''' -a -n ''''
'']''
> + destination=0.0.0.0/0
> + ''['' -n '''' '']''
> + destnet=-d 0.0.0.0/0
> + ''['' -n ''255.255.255.255/32
> 192.168.0.0/24'' '']''
> + ''['' -n '''' '']''
> + addnatrule ppp0_masq -s 255.255.255.255/32 -d 0.0.0.0/0 -j MASQUERADE
> + ensurenatchain ppp0_masq
> + havenatchain ppp0_masq
> + eval test ''"$ppp0_masq_nat_exists"'' = Yes
> ++ test '''' = Yes
> + createnatchain ppp0_masq
> + run_iptables -t nat -N ppp0_masq
> + iptables -t nat -N ppp0_masq
> + eval ppp0_masq_nat_exists=Yes
> ++ ppp0_masq_nat_exists=Yes
> + run_iptables2 -t nat -A ppp0_masq -s 255.255.255.255/32 -d 0.0.0.0/0 -j
> MASQUERADE
> + ''['' ''x-t nat -A ppp0_masq -s
255.255.255.255/32 -d 0.0.0.0/0 -j
> MASQUERADE'' = ''x-t nat -A ppp0_masq -s 255.255.255.255/32
-d 0.0.0.0/0 -j
> MASQUERADE'' '']''
> + run_iptables -t nat -A ppp0_masq -s 255.255.255.255/32 -d 0.0.0.0/0 -j
> MASQUERADE
> + iptables -t nat -A ppp0_masq -s 255.255.255.255/32 -d 0.0.0.0/0 -j
> MASQUERADE
> iptables: Invalid argument
> + ''['' -z '''' '']''
> + stop_firewall
> + set +x
>
> This is _not_ the version of shorewall that came with Mandrake (I heeded
> the instructions in the quick start which said to remove
Mandrake''s
> shorewall package and install one from the shorewall site).
>
> Phil
>
>
> _______________________________________________
> Shorewall-users mailing list
> Post: Shorewall-users@lists.shorewall.net
> Subscribe/Unsubscribe:
http://lists.shorewall.net/mailman/listinfo/shorewall-users
> Support: http://www.shorewall.net/support.htm
> FAQ: http://www.shorewall.net/FAQ.htm