Re: Can't run shorewall with kernel 2.6.20.2
On Sat, 10 Mar 2007 14:53:37 +0100
"Adrián Ebay" <achapela.rexistros@gmail.com> wrote:
> Seems to be a compilation error.
>
> Have you all the iptables modules ?? Check if you have all the modules. The
> problem isn´t shorewall, it is the iptables.
>
It seems that the command that is failing at the moment is:
/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
If try to run it by itself (with the -v option) I get the error:
ACCEPT 0 opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 state RELATED,ESTABLISHED
iptables: Invalid argument
running just
/sbin/iptables -A FORWARD -j ACCEPT
works so it's something with the -m state option. Any idea what module is
needed?
I tried compiling xt_state, xt_conntrack and nf_conntrack which seemed related
but they didn't help. Nothing else that seems to fit from previous kernels. The
only modules that seem to be missing from this version of the kernel and I
can't find options to compile them are:
ipt_hashlimit.ko
ip_conntrack_ftp.ko
ip_conntrack.ko
Thanks
> 2007/3/10, Roberto C. Sanchez <roberto@connexer.com>:
> >
> > On Sat, Mar 10, 2007 at 05:00:34AM +0200, Micha Feigin wrote:
> > > I tried upgrading to kernel 2.6.20 and 2.6.20.2 but shorewall refuses to
> > start.
> > >
> > > The only error I get is: (from /var/log/shorewall-init.log)
> > >
> > > [...]
> > > Shorewall configuration compiled to /var/lib/shorewall/.start
> > > Starting Shorewall....
> > > Initializing...
> > > Clearing Traffic Control/QOS
> > > Deleting user chains...
> > > iptables: No chain/target/match by that name
> > > ERROR: Command "/sbin/iptables -A FORWARD -m state --state
> > ESTABLISHED,RELATED -j ACCEPT" Failed
> > > iptables: No chain/target/match by that name
> > > iptables: No chain/target/match by that name
> > > /sbin/shorewall: line 531: 1991
> > Terminated ${VARDIR}/.start $debugging start
> > >
> > Please provide the following:
> >
> > distribution of Debian
> > version of shorewall
> > version of iptables
> > method by which kernel was built
> >
> > Regards,
> >
> > -Roberto
> >
> > --
> > Roberto C. Sanchez
> > http://people.connexer.com/~roberto
> > http://www.connexer.com
> >
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.4.1 (GNU/Linux)
> >
> > iD8DBQFF8ioW1snWssAFC08RAkBDAJ9GE/vrdnd/bfS4fmJUgvzP2sicgwCfd1ga
> > GQDT8dvra0E0B7hN+XN8+NU=
> > =VrAl
> > -----END PGP SIGNATURE-----
> >
> >
Reply to: