From 24d75ad5ed67d5515727a2e8e1ffb869cec4905f Mon Sep 17 00:00:00 2001 From: teastep Date: Tue, 26 Jun 2007 15:41:12 +0000 Subject: [PATCH] Yet another batch of 4.0 Doc updates git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@6680 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb --- docs/troubleshoot.xml | 169 ++++++++++++++++++++++++++++++++---------- 1 file changed, 128 insertions(+), 41 deletions(-) diff --git a/docs/troubleshoot.xml b/docs/troubleshoot.xml index 4cfdcd1af..3db0e8a7c 100644 --- a/docs/troubleshoot.xml +++ b/docs/troubleshoot.xml @@ -36,56 +36,61 @@ <quote>shorewall start</quote> and <quote>shorewall restart</quote> Errors - You receive an error message when starting or restarting the - firewall and you can't determine the cause. First, if your VERBOSITY - setting in shorewall.conf is less than 2, then try running with a higher - verbosity level by using the "-v" option: +
+ Shorewall-shell -
- shorewall -vv [re]start -
+ If you use the Shorewall-shell compiler and you receive an error + message when starting or restarting the firewall and you can't determine + the cause. First, if your VERBOSITY setting in shorewall.conf is less + than 2, then try running with a higher verbosity level by using the "-v" + option: - That will give you additional progress messages that may make it - clear which entry in which file is generating the error. +
+ shorewall -vv [re]start +
- If that didn't help, then do the following: + That will give you additional progress messages that may make it + clear which entry in which file is generating the error. - - - Make a note of the error message that you see. - + If that didn't help, then do the following: - - shorewall debug start 2> /tmp/trace - + + + Make a note of the error message that you see. + - - Look at the /tmp/trace file and see if that - helps you determine what the problem is. Be sure you find the place in - the log where the error message you saw is generated -- If you are - using Shorewall 1.4.0 or later, you should find the message near the - end of the log. - + + shorewall debug start 2> + /tmp/trace + - - If you still can't determine what's wrong then see the support page. - - + + Look at the /tmp/trace file and see if + that helps you determine what the problem is. Be sure you find the + place in the log where the error message you saw is generated -- If + you are using Shorewall 1.4.0 or later, you should find the message + near the end of the log. + - - Startup Error + + If you still can't determine what's wrong then see the support page. + + - During startup, a user sees the following: + + Startup Error - Adding Common Rules + During startup, a user sees the following: + + Adding Common Rules iptables: No chain/target/match by that name Terminated - A search through the trace for No chain/target/match by - that name turned up the following: + A search through the trace for No chain/target/match by + that name turned up the following: - + echo 'Adding Common Rules' + + echo 'Adding Common Rules' + add_common_rules + run_iptables -A reject -p tcp -j REJECT --reject-with tcp-reset ++ echo -A reject -p tcp -j REJECT --reject-with tcp-reset @@ -94,11 +99,93 @@ Terminated iptables: No chain/target/match by that name - The command that failed was: iptables -A reject -p - tcp -j REJECT --reject-with tcp-reset. In this case, - the user had compiled his own kernel and had forgotten to include REJECT - target support (see kernel.htm) - + The command that failed was: iptables -A reject + -p tcp -j REJECT --reject-with tcp-reset. In this + case, the user had compiled his own kernel and had forgotten to + include REJECT target support (see kernel.htm) + +
+ +
+ Shorewall-perl + + If the error is detected by the Shorewall-perl compiler, it should + be fairly obvious where the problem was found. Each error message + includes the configuration file name and line number where the error was + detected and often gives the particular item in error. The item is + either enclosed in parentheses or is at the end following a colon + (":"). + + Example:gateway:~/test # shorewall restart . +Compiling... + ERROR: Invalid ICMP Type (0/400) : /root/test/rules (line 19) +gateway:~/test # In this case, line 19 in the rules file + specified an invalid ICMP Type (0/400). + + Additional information about the error can be obtained using the + 'debug' keyword:gateway:~/test # shorewall debug restart . +Compiling... + ERROR: Invalid ICMP Type (0/400) : /root/test/rules (line 19) at /usr/share/shorewall-perl/Shorewall/Config.pm line 338 + Shorewall::Config::fatal_error('Invalid ICMP Type (0/400)') called at /usr/share/shorewall-perl/Shorewall/Chains.pm line 885 + Shorewall::Chains::validate_icmp('0/400') called at /usr/share/shorewall-perl/Shorewall/Chains.pm line 949 + Shorewall::Chains::do_proto('icmp', '0/400', '-') called at /usr/share/shorewall-perl/Shorewall/Rules.pm line 1055 + Shorewall::Rules::process_rule1('ACCEPT', 'loc', 'net', 'icmp', '0/400', '-', '-', '-', '-', ...) called at /usr/share/shorewall-perl/Shorewall/Rules.pm line 1290 + Shorewall::Rules::process_rule('ACCEPT', 'loc', 'net', 'icmp', '0/400', '-', '-', '-', '-', ...) called at /usr/share/shorewall-perl/Shorewall/Rules.pm line 1336 + Shorewall::Rules::process_rules() called at /usr/share/shorewall-perl/Shorewall/Compiler.pm line 799 + Shorewall::Compiler::compiler('/var/lib/shorewall/.restart', '/root/test', 0, 4) called at /usr/share/shorewall-perl/compiler.pl line 86 +gateway:~/test # This information is useful to Shorewall + support if you need to file a problem + report. + + The end of the compile phase is signaled by a message such as the + following:Shorewall configuration compiled to /var/lib/shorewall/.restartErrors + occuring past that point are said to occur at + run-time because they occur during the running of + the compiled firewall script (/var/lib/shorewall/.restart in the case of + the above message). + + One common run-time failure is that the iptables-restore program + encounters an error. This will produce an error such as the + following:... +Restarting Shorewall.... +iptables-restore v1.3.6: No chain/target/match by that name +Error occurred at line: 83 +Try `iptables-restore -h' or 'iptables-restore --help' for more information. + ERROR: iptables-restore Failed. Input is in /var/lib/shorewall/.iptables-restore-input +Restoring Shorewall... +Shorewall restored from /var/lib/shorewall/restore +Terminated +gateway:~/test # A look at /var/lib/shorewall/restore at line + 83 might show something like the following:-A reject -p tcp -j REJECT --reject-with tcp-resetIn + this case, the user had compiled his own kernel and had forgotten to + include REJECT target support (see kernel.htm). + + In other run-time failure cases: + + Make a note of the error message that you see. + + + + shorewall debug start 2> + /tmp/trace + + + + Look at the /tmp/trace file and see if + that helps you determine what the problem is. Be sure you find the + place in the log where the error message you saw is generated -- + If you are using Shorewall 1.4.0 or later, you should find the + message near the end of the log. + + + + If you still can't determine what's wrong then see the + support page. + + +