shorewall needs restart to work properly

brazzmonkey · 2010-05-23 21:18:37

Hi there,
lately I updated shorewall (4.4.9-1) on my gateway, and realized I need to restart it in order to get it working properly.
shorewall is in my rc.conf, and _seems_ to be started at boot time. But my local network computers cannot access the internet. After I "/etc/rc.d/shorewall restart" everything's back to normal.
I tried to change daemons order in rc.conf, unbackgrounded shorewall, but it doesn't help.

Any guidance would be appreciated,

thanks.

brazzmonkey · 2010-05-25 07:18:42

I bump this thread because I realised that shorewall only works properly when restarted. I mean, manually stopping then starting shorewall doesn't help. Couls that be related to an error in the init scripts (just trying to guess)?

brazzmonkey · 2010-05-25 22:02:42

As a dirty workaround I added /etc/rc.d/shorewall restart to my rc.local. It works but it's a bit counter productive...

jib2 · 2010-05-26 05:49:20

Well, that's weird because shorewall is not really a daemon, it's just a script that is run once. Restarting it when you didn't change anything in the rules shouldn't have any effect.
shorewall works fine on my computer. It's placed just before network in my rc.conf daemon list.

brazzmonkey · 2010-05-26 09:03:43

Yes, I know that shorewall is not a daemon, that's why I don't know why it needs to be restarted...
I tried to manually stop it, then start it. My internet connection stopped working.
I then restarted it, and everything works again. Here is the log, if it can help

** STOPPING**
May 26 10:42:15 Stopping Shorewall....
May 26 10:42:15 Processing /etc/shorewall/stop ...
May 26 10:42:15 Processing /etc/shorewall/tcclear ...
May 26 10:42:15 Running /usr/sbin/iptables-restore...
May 26 10:42:16 IPv4 Forwarding Enabled
May 26 10:42:16 Processing /etc/shorewall/stopped ...
rm: cannot remove `/var/run': Is a directory
May 26 10:42:16 done.
** STARTING**
May 26 10:42:21 Initializing...
May 26 10:42:21 Loading Modules...
May 26 10:42:26 Processing /etc/shorewall/init ...
May 26 10:42:26 Setting up ARP filtering...
May 26 10:42:26 Setting up Route Filtering...
May 26 10:42:26 Setting up Martian Logging...
May 26 10:42:26 Setting up Accept Source Routing...
May 26 10:42:26 Setting up Proxy ARP...
May 26 10:42:26 Setting up Traffic Control...
May 26 10:42:26 IPv4 Forwarding Enabled
May 26 10:42:26 Processing /etc/shorewall/restored ...
**RESTARTING (I guess)**
May 26 10:42:50 Processing /etc/shorewall/shorewall.conf...
May 26 10:42:50 Loading Modules...
May 26 10:42:56    WARNING: RFC1918_LOG_LEVEL=6 ignored. The 'norfc1918' interface/host option is no longer supported
May 26 10:42:56 Compiling /etc/shorewall/zones...
May 26 10:42:56 Compiling /etc/shorewall/interfaces...
May 26 10:42:56    Interface "net eth0 detect dhcp,tcpflags,routefilter,nosmurfs,logmartians" Validated
May 26 10:42:56    Interface "loc eth1 detect tcpflags,nosmurfs,dhcp" Validated
May 26 10:42:56 Determining Hosts in Zones...
May 26 10:42:56    fw (firewall)
May 26 10:42:56    net (ipv4)
May 26 10:42:56       eth0:0.0.0.0/0
May 26 10:42:56    loc (ipv4)
May 26 10:42:56       eth1:0.0.0.0/0
May 26 10:42:56 Preprocessing Action Files...
May 26 10:42:56    Pre-processing /usr/share/shorewall/action.Drop...
May 26 10:42:56     ..Expanding Macro /usr/share/shorewall/macro.Auth...
May 26 10:42:56     ..End Macro /usr/share/shorewall/macro.Auth
May 26 10:42:56     ..Expanding Macro /usr/share/shorewall/macro.AllowICMPs...
May 26 10:42:56     ..End Macro /usr/share/shorewall/macro.AllowICMPs
May 26 10:42:56     ..Expanding Macro /usr/share/shorewall/macro.SMB...
May 26 10:42:56     ..End Macro /usr/share/shorewall/macro.SMB
May 26 10:42:56     ..Expanding Macro /usr/share/shorewall/macro.DropUPnP...
May 26 10:42:56     ..End Macro /usr/share/shorewall/macro.DropUPnP
May 26 10:42:56     ..Expanding Macro /usr/share/shorewall/macro.DropDNSrep...
May 26 10:42:56     ..End Macro /usr/share/shorewall/macro.DropDNSrep
May 26 10:42:56    Pre-processing /usr/share/shorewall/action.Reject...
May 26 10:42:56     ..Expanding Macro /usr/share/shorewall/macro.Auth...
May 26 10:42:56     ..End Macro /usr/share/shorewall/macro.Auth
May 26 10:42:56     ..Expanding Macro /usr/share/shorewall/macro.SMB...
May 26 10:42:56     ..End Macro /usr/share/shorewall/macro.SMB
May 26 10:42:56 Compiling /etc/shorewall/policy...
May 26 10:42:56    Policy for loc to net is ACCEPT using chain loc2net
May 26 10:42:56    Policy for loc to fw is ACCEPT using chain loc2fw
May 26 10:42:56    Policy for loc to fw is REJECT using chain loc2all
May 26 10:42:56    Policy for loc to net is REJECT using chain loc2all
May 26 10:42:56    Policy for fw to net is ACCEPT using chain fw2net
May 26 10:42:56    Policy for fw to loc is ACCEPT using chain fw2loc
May 26 10:42:56    Policy for fw to net is REJECT using chain fw2all
May 26 10:42:56    Policy for fw to loc is REJECT using chain fw2all
May 26 10:42:56    Policy for net to fw is DROP using chain net2fw
May 26 10:42:56    Policy for net to loc is DROP using chain net2loc
May 26 10:42:56    Policy for net to fw is DROP using chain net2all
May 26 10:42:56    Policy for net to loc is DROP using chain net2all
May 26 10:42:56    Policy for fw to net is REJECT using chain all2all
May 26 10:42:56    Policy for fw to loc is REJECT using chain all2all
May 26 10:42:56    Policy for net to fw is REJECT using chain all2all
May 26 10:42:56    Policy for net to loc is REJECT using chain all2all
May 26 10:42:56    Policy for loc to fw is REJECT using chain all2all
May 26 10:42:56    Policy for loc to net is REJECT using chain all2all
May 26 10:42:57 Processing /etc/shorewall/initdone...
May 26 10:42:57 Adding Anti-smurf Rules
May 26 10:42:57 Adding rules for DHCP
May 26 10:42:57 Compiling TCP Flags filtering...
May 26 10:42:57 Compiling Kernel Route Filtering...
May 26 10:42:57 Compiling Martian Logging...
May 26 10:42:57 Compiling /etc/shorewall/tcdevices...
May 26 10:42:57    Tcdevice "eth0 8mbit 1mbit" Compiled.
May 26 10:42:57    Tcdevice "eth1 100mbit 100mbit" Compiled.
May 26 10:42:57 Compiling /etc/shorewall/tcclasses...
May 26 10:42:57    Tcclass "eth0 1 full full 0" Compiled.
May 26 10:42:57    WARNING: Total RATE of classes (2000kbits) exceeds OUT-BANDWIDTH (1000kbits) : /etc/shorewall/tcclasses (line 11)
May 26 10:42:57    Tcclass "eth0 2 full full 5" Compiled.
May 26 10:42:57    WARNING: Total RATE of classes (3000kbits) exceeds OUT-BANDWIDTH (1000kbits) : /etc/shorewall/tcclasses (line 12)
May 26 10:42:57    Tcclass "eth0 3 full full 10 default " Compiled.
May 26 10:42:57 Compiling /etc/shorewall/tcrules...
May 26 10:42:57    TC Rule "1 0.0.0.0/0 0.0.0.0/0 tcp 2210" Compiled
May 26 10:42:57    TC Rule "2 0.0.0.0/0 0.0.0.0/0 tcp 80" Compiled
May 26 10:42:57    TC Rule "2 0.0.0.0/0 0.0.0.0/0 tcp 443" Compiled
May 26 10:42:57    TC Rule "3 0.0.0.0/0 0.0.0.0/0 all " Compiled
May 26 10:42:57 Compiling /etc/shorewall/masq...
May 26 10:42:57    WARNING: Using an interface as the masq SOURCE requires the interface to be up and configured when Shorewall starts/restarts : /etc/shorewall/masq (line 18)
May 26 10:42:57     Masq record "eth0 eth1 " Compiled
May 26 10:42:57 Compiling MAC Filtration -- Phase 1...
May 26 10:42:57 Compiling /etc/shorewall/rules...
May 26 10:42:57 ..Expanding Macro /usr/share/shorewall/macro.DNS...
May 26 10:42:57     Rule "PARAM - - udp 53" Compiled
May 26 10:42:57     Rule "PARAM - - tcp 53" Compiled
May 26 10:42:57 ..End Macro /usr/share/shorewall/macro.DNS
May 26 10:42:57     Rule "DNS/ACCEPT fw net" Compiled
May 26 10:42:57 ..Expanding Macro /usr/share/shorewall/macro.DNS...
May 26 10:42:57     Rule "PARAM - - udp 53" Compiled
May 26 10:42:57     Rule "PARAM - - tcp 53" Compiled
May 26 10:42:57 ..End Macro /usr/share/shorewall/macro.DNS
May 26 10:42:57     Rule "DNS/ACCEPT loc fw" Compiled
May 26 10:42:57     Rule "ACCEPT loc fw TCP 2210" Compiled
May 26 10:42:57     Rule "ACCEPT fw loc TCP 2210" Compiled
May 26 10:42:57     Rule "ACCEPT loc fw TCP 631" Compiled
May 26 10:42:57     Rule "DROP net fw TCP 631" Compiled
May 26 10:42:57     Rule "ACCEPT fw loc TCP 631" Compiled
May 26 10:42:57     Rule "DROP fw net TCP 631" Compiled
May 26 10:42:57     Rule "ACCEPT loc fw UDP 631" Compiled
May 26 10:42:57     Rule "DROP net fw UDP 631" Compiled
May 26 10:42:57     Rule "ACCEPT fw loc UDP 631" Compiled
May 26 10:42:57     Rule "DROP fw net UDP 631" Compiled
May 26 10:42:57     Rule "ACCEPT loc fw TCP 21" Compiled
May 26 10:42:57     Rule "ACCEPT net fw TCP 5662" Compiled
May 26 10:42:57     Rule "ACCEPT net fw UDP 5665,5672" Compiled
May 26 10:42:57     Rule "ACCEPT fw net TCP 5662" Compiled
May 26 10:42:57     Rule "ACCEPT fw net UDP 5665,5672" Compiled
May 26 10:42:57     Rule "ACCEPT fw loc TCP 4711,4712" Compiled
May 26 10:42:57     Rule "ACCEPT loc fw TCP 4711,4712" Compiled
May 26 10:42:57     Rule "ACCEPT loc fw TCP 14610,14620,14640" Compiled
May 26 10:42:57     Rule "ACCEPT loc fw UDP 14610,14620,14640" Compiled
May 26 10:42:57     Rule "ACCEPT fw loc TCP 14610,14620,14640" Compiled
May 26 10:42:57     Rule "ACCEPT fw loc UDP 14610,14620,14640" Compiled
May 26 10:42:57     Rule "ACCEPT loc fw icmp" Compiled
May 26 10:42:57     Rule "ACCEPT fw loc icmp" Compiled
May 26 10:42:57     Rule "ACCEPT fw net UDP 123" Compiled
May 26 10:42:57     Rule "ACCEPT loc fw UDP 123" Compiled
May 26 10:42:57     Rule "REDIRECT loc 3128 tcp www - !192.168.0.10" Compiled
May 26 10:42:57     Rule "ACCEPT fw net tcp www" Compiled
May 26 10:42:57     Rule "DROP net fw TCP 113" Compiled
May 26 10:42:57 Generating Transitive Closure of Used-action List...
May 26 10:42:57 Processing /usr/share/shorewall/action.Reject for chain Reject...
May 26 10:42:57 ..Expanding Macro /usr/share/shorewall/macro.Auth...
May 26 10:42:57 ..End Macro
May 26 10:42:57 ..Expanding Macro /usr/share/shorewall/macro.AllowICMPs...
May 26 10:42:57 ..End Macro
May 26 10:42:57 ..Expanding Macro /usr/share/shorewall/macro.SMB...
May 26 10:42:57 ..End Macro
May 26 10:42:57 ..Expanding Macro /usr/share/shorewall/macro.DropUPnP...
May 26 10:42:57 ..End Macro
May 26 10:42:57 ..Expanding Macro /usr/share/shorewall/macro.DropDNSrep...
May 26 10:42:57 ..End Macro
May 26 10:42:57 Processing /usr/share/shorewall/action.Drop for chain Drop...
May 26 10:42:57 ..Expanding Macro /usr/share/shorewall/macro.Auth...
May 26 10:42:57 ..End Macro
May 26 10:42:57 ..Expanding Macro /usr/share/shorewall/macro.AllowICMPs...
May 26 10:42:57 ..End Macro
May 26 10:42:57 ..Expanding Macro /usr/share/shorewall/macro.SMB...
May 26 10:42:57 ..End Macro
May 26 10:42:57 ..Expanding Macro /usr/share/shorewall/macro.DropUPnP...
May 26 10:42:57 ..End Macro
May 26 10:42:57 ..Expanding Macro /usr/share/shorewall/macro.DropDNSrep...
May 26 10:42:57 ..End Macro
May 26 10:42:57 Compiling MAC Filtration -- Phase 2...
May 26 10:42:57 Applying Policies...
May 26 10:42:57    Policy ACCEPT from fw to net using chain fw2net
May 26 10:42:57    Policy ACCEPT from fw to loc using chain fw2loc
May 26 10:42:57    Policy DROP from net to fw using chain net2fw
May 26 10:42:57    Policy DROP from net to loc using chain net2loc
May 26 10:42:57    Policy ACCEPT from loc to fw using chain loc2fw
May 26 10:42:57    Policy ACCEPT from loc to net using chain loc2net
May 26 10:42:57 Generating Rule Matrix...
May 26 10:42:57    Chain eth0_out deleted
May 26 10:42:57    Chain eth0_in deleted
May 26 10:42:58    Chain eth0_fwd deleted
May 26 10:42:58    Chain eth1_out deleted
May 26 10:42:58    Chain eth1_in deleted
May 26 10:42:58    Chain eth1_fwd deleted
May 26 10:42:58 Optimizing Ruleset...
May 26 10:42:58 Creating iptables-restore input...
May 26 10:42:58 Compiling iptables-restore input for chain mangle:...
May 26 10:42:58 Compiling /etc/shorewall/routestopped...
May 26 10:42:58 Shorewall configuration compiled to /var/lib/shorewall/.restart
May 26 10:42:58 Restarting Shorewall....
May 26 10:42:59 Initializing...
May 26 10:42:59 Loading Modules...
May 26 10:43:03 Processing /etc/shorewall/init ...
May 26 10:43:03 Processing /etc/shorewall/tcclear ...
May 26 10:43:03 Setting up Route Filtering...
May 26 10:43:04 Setting up Martian Logging...
May 26 10:43:04 Setting up Proxy ARP...
May 26 10:43:04 Setting up Traffic Control...
May 26 10:43:04    TC Device eth0 defined.
May 26 10:43:04    TC Device eth1 defined.
May 26 10:43:04    TC Class 1:11 defined.
May 26 10:43:04    TC Class 1:12 defined.
May 26 10:43:04    TC Class 1:13 defined.
May 26 10:43:04 Preparing iptables-restore input...
May 26 10:43:04 Running /usr/sbin/iptables-restore...
May 26 10:43:04 Setting up dynamic rules...
May 26 10:43:04 IPv4 Forwarding Enabled
May 26 10:43:04 Processing /etc/shorewall/start ...
May 26 10:43:04 Processing /etc/shorewall/started ...
May 26 10:43:04 done.

brazzmonkey · 2010-09-30 07:12:51

Well, I've been having this issue for months, but eventually everything's back to normal without any particular reason (maybe an update?)...

Arch Linux

#1 2010-05-23 21:18:37

shorewall needs restart to work properly

#2 2010-05-25 07:18:42

Re: shorewall needs restart to work properly

#3 2010-05-25 22:02:42

Re: shorewall needs restart to work properly

#4 2010-05-26 05:49:20

Re: shorewall needs restart to work properly

#5 2010-05-26 09:03:43

Re: shorewall needs restart to work properly

#6 2010-09-30 07:12:51

Re: shorewall needs restart to work properly

Board footer