Re: loading netfilter modules

Tom Eastep
Tue, 03 Feb 2009 20:51:02 -0000

Brian J. Murrell wrote
>
> Yeah.  That''s what I have been trying to figure out/work with
given
> that I was not getting modules autoloaded.

The problem isn''t that modules aren''t autoloaded but that the
autoloading comes after the ''state match'' check :-(

We added that check because Gentoo users often build kernels with the
bare minimum netfilter support and then ask why it doesn''t work.

>
> I have not see where in "shorewall reload" (on a shorewall-lite
> machine) this is actually happening.  The modules are stored in the
> "<state_dir>/.modules" but I don''t see any effort
to try to load
> them.
>
> xtrace from the restore script shows all of the execution prior to
> the test for the state module as being:
>
> + LEFTSHIFT=<<
...
> + qt1 /usr/sbin/iptables -A foox1234 -m state --state
> ESTABLISHED,RELATED -j ACCEPT
>
> Perhaps the modules loading is supposed to happen before the call to
> the restore script?

Attached is a patch which moves the state match test to after module
loading occurs. Please give it a try.

-Tom
--
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________