Shorewall users - May 2006 - start error: after macro.DropDNSrep, Fatal error in find_logactionchain

>shorewall start
<--snip-->
..Expanding Macro /usr/share/shorewall/macro.DropDNSrep...
   Rule "DROP - - udp - 53  -" added.
..End Macro
   ERROR: Fatal error in find_logactionchain
Terminated

[root@featherweight ]# cat /etc/issue
CentOS release 4.3 (Final)
(think RHEL)

[root@featherweight ]# rpm -q shorewall
shorewall-3.0.7-1

This machine is a pent 233 with 128 megs RAM --- don''t know if that
effects anything, and I don''t think it would.

It''s been a few versions since I installed Shorewall, but I
"think" that I''m still doing it right.

I know that I should probably be flogged for not providing enough info.
I''m still searching for an answer on my own, but any help is greatly
appreciated in advance.

Brian Neu wrote:
>>shorewall start
> 
> I know that I should probably be flogged for not providing enough info.
Please see http://www.shorewall.net/support.htm for instructions for
reporting startup failure problems.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

Well, I was right about the flogging part!

Problem solved, but still a partial mystery.  I had the UPnP option on loc /
eth1.  Apparently, this system didn''t like that option.

I''ve attached my trace in an effort to make amends and maybe an answer
as to why.

Many thanks Godfather Tom.


Tom Eastep <teastep@shorewall.net> wrote: Brian Neu
wrote:
>>shorewall start
> 
> I know that I should probably be flogged for not providing enough info.
Please see http://www.shorewall.net/support.htm for instructions for
reporting startup failure problems.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

Brian Neu wrote:
> Well, I was right about the flogging part!
> 
> Problem solved, but still a partial mystery.  I had the UPnP option on
> loc / eth1.  Apparently, this system didn''t like that option.
> 
> I''ve attached my trace in an effort to make amends and maybe an
answer
> as to why.
Brian,

The error is fallout from this warning that Shorewall issued earlier:

WARNING:Missing forwardUPnP rule (required by ''upnp'' interface
option on
eth1)

If you add the missing rule, the error goes away.

If you use the "-q" option when you manually [re]start Shorewall, a
lot
of the output is surpressed and it''s easier to spot warning messages
like the one shown above.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key