mirror of
https://gitlab.com/shorewall/code.git
synced 2025-08-16 19:56:48 +02:00
Changes for 1.3.7
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@208 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
@ -10,57 +10,62 @@
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="radial 011">
|
||||
</head>
|
||||
<body background="_themes/radial/radbkgnd.gif" bgcolor="#FFFFFF" text="#000000" link="#6666FF" vlink="#993333" alink="#66CCCC"><!--mstheme--><font face="arial, Arial, Helvetica">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
|
||||
<h1 align="center"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Shorewall Troubleshooting<!--mstheme--></font></h1>
|
||||
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#FFFFFF">Shorewall Troubleshooting</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
<h3 align="Left"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Check the Errata<!--mstheme--></font></h3>
|
||||
<h3 align="Left">Check the Errata</h3>
|
||||
|
||||
<p align="Left">Check the <a href="errata.htm">Shorewall Errata</a>
|
||||
to be sure that there isn't an update that you are missing for your version
|
||||
of the firewall.</p>
|
||||
|
||||
<h3 align="Left"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Check the FAQs<!--mstheme--></font></h3>
|
||||
<h3 align="Left">Check the FAQs</h3>
|
||||
|
||||
<p align="Left">Check the <a href="FAQ.htm">FAQs</a> for solutions to common problems.</p>
|
||||
|
||||
|
||||
|
||||
<h3 align="Left"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">If the firewall fails to start<!--mstheme--></font></h3>
|
||||
<h3 align="Left">If the firewall fails to start</h3>
|
||||
|
||||
If you
|
||||
receive an error message when starting or restarting the firewall and you
|
||||
can't determine the cause, then do the following:
|
||||
<!--mstheme--></font><!--msthemelist--><table border="0" cellpadding="0" cellspacing="0" width="100%">
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">shorewall debug start 2> /tmp/trace<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Look at the /tmp/trace file and see if that helps you determine what
|
||||
the problem is.<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">If you still can't determine what's wrong then see the
|
||||
<a href="support.htm">support page</a>.<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--></table><!--mstheme--><font face="arial, Arial, Helvetica">
|
||||
<h3><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Your test environment<!--mstheme--></font></h3>
|
||||
<ul>
|
||||
<li>shorewall debug start 2> /tmp/trace</li>
|
||||
<li>Look at the /tmp/trace file and see if that helps you determine what
|
||||
the problem is.</li>
|
||||
<li>If you still can't determine what's wrong then see the
|
||||
<a href="support.htm">support page</a>.</li>
|
||||
</ul>
|
||||
<h3>Your test environment</h3>
|
||||
<p>Many times when people have problems with Shorewall, the problem is
|
||||
actually an ill-conceived test setup. Here are several popular snafus: </p>
|
||||
<!--mstheme--></font><!--msthemelist--><table border="0" cellpadding="0" cellspacing="0" width="100%">
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Port
|
||||
<ul>
|
||||
<li>Port
|
||||
Forwarding where client and server are in the same subnet. See <a href="FAQ.htm">FAQ
|
||||
2.</a><!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Changing the IP address of a local system to be in the external subnet,
|
||||
2.</a></li>
|
||||
<li>Changing the IP address of a local system to be in the external subnet,
|
||||
thinking that Shorewall will suddenly believe that the system is in the
|
||||
'net' zone.<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Multiple interfaces connected to the same HUB or Switch. Given the way
|
||||
'net' zone.</li>
|
||||
<li>Multiple interfaces connected to the same HUB or Switch. Given the way
|
||||
that the Linux kernel respond to ARP "who-has" requests, this type of setup
|
||||
does NOT work the way that you expect it to.<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--></table><!--mstheme--><font face="arial, Arial, Helvetica">
|
||||
does NOT work the way that you expect it to.</li>
|
||||
</ul>
|
||||
|
||||
<h3 align="Left"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">If you are having
|
||||
connection problems:<!--mstheme--></font></h3>
|
||||
<h3 align="Left">If you are having
|
||||
connection problems:</h3>
|
||||
|
||||
<p align="Left">If the appropriate policy for the connection that you
|
||||
are trying to make is ACCEPT, please DO NOT ADD ADDITIONAL ACCEPT RULES TRYING
|
||||
@ -100,16 +105,16 @@ ID=5805 DF PROTO=UDP SPT=1803 DPT=53 LEN=47</font></p>
|
||||
|
||||
<p align="Left">Let's look at the important parts of this message:</p>
|
||||
|
||||
<!--mstheme--></font><!--msthemelist--><table border="0" cellpadding="0" cellspacing="0" width="100%">
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">all2all:REJECT - the packet was rejected under the "all"->"all" REJECT
|
||||
policy<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">IN=eth2 - the packet entered the firewall via eth2<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">OUT=eth1 - if accepted, the packet would be sent on eth1<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">SRC=192.168.2.2 - the packet was sent by 192.168.2.2<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">DST=192.168.1.3 - the packet is destined for 192.168.1.3<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">PROTO=UDP - UDP Protocol<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">DPT=53 - DNS<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--></table><!--mstheme--><font face="arial, Arial, Helvetica">
|
||||
<ul>
|
||||
<li>all2all:REJECT - the packet was rejected under the "all"->"all" REJECT
|
||||
policy</li>
|
||||
<li>IN=eth2 - the packet entered the firewall via eth2</li>
|
||||
<li>OUT=eth1 - if accepted, the packet would be sent on eth1</li>
|
||||
<li>SRC=192.168.2.2 - the packet was sent by 192.168.2.2</li>
|
||||
<li>DST=192.168.1.3 - the packet is destined for 192.168.1.3</li>
|
||||
<li>PROTO=UDP - UDP Protocol</li>
|
||||
<li>DPT=53 - DNS</li>
|
||||
</ul>
|
||||
|
||||
<p align="Left">In this case, 192.168.2.2 was in the "dmz" zone and
|
||||
192.168.1.3 is in the "loc" zone. I was missing the rule:</p>
|
||||
@ -118,10 +123,10 @@ policy<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
|
||||
|
||||
|
||||
<h3 align="Left"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Other Gotchas<!--mstheme--></font></h3>
|
||||
<h3 align="Left">Other Gotchas</h3>
|
||||
|
||||
<!--mstheme--></font><!--msthemelist--><table border="0" cellpadding="0" cellspacing="0" width="100%">
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Remember that Shorewall doesn't automatically allow ICMP type 8 ("ping")
|
||||
<ul>
|
||||
<li>Remember that Shorewall doesn't automatically allow ICMP type 8 ("ping")
|
||||
requests to be sent between zones. If you want pings to be allowed between
|
||||
zones, you need a rule of the form:<br>
|
||||
<br>
|
||||
@ -136,40 +141,40 @@ icmp
|
||||
and you ping 130.252.100.18, unless you have allowed icmp type 8 between
|
||||
the zone containing the system you are pinging from and the zone containing
|
||||
10.1.1.2, the ping requests will be dropped. This is true even if you
|
||||
have NOT specified 'noping' for eth0 in /etc/shorewall/interfaces.<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">If you specify "routefilter" for an interface, that interface must be
|
||||
up prior to starting the firewall.<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Is your routing correct? For example, internal systems usually need to
|
||||
have NOT specified 'noping' for eth0 in /etc/shorewall/interfaces.</li>
|
||||
<li>If you specify "routefilter" for an interface, that interface must be
|
||||
up prior to starting the firewall.</li>
|
||||
<li>Is your routing correct? For example, internal systems usually need to
|
||||
be configured with their default gateway set to the IP address of their
|
||||
nearest firewall interface. One often overlooked aspect of routing is that
|
||||
in order for two hosts to communicate, the routing between them must be set
|
||||
up <u>in both directions.</u> So when setting up routing between <b>A</b>
|
||||
and<b> B</b>, be sure to verify that the route from <b>B</b> back to <b>A</b>
|
||||
is defined.<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Some versions of LRP (EigerStein2Beta for example) have a shell with
|
||||
is defined.</li>
|
||||
<li>Some versions of LRP (EigerStein2Beta for example) have a shell with
|
||||
broken variable expansion. <a href="ftp://ftp.shorewall.net/pub/shorewall/ash.gz">
|
||||
You can get a corrected shell from the Shorewall Errata download site.</a>
|
||||
<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Do you have your kernel properly configured? <a href="kernel.htm">Click
|
||||
here to see my kernel configuration.</a> <!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Some features require the "ip" program. That program is generally included
|
||||
</li>
|
||||
<li>Do you have your kernel properly configured? <a href="kernel.htm">Click
|
||||
here to see my kernel configuration.</a> </li>
|
||||
<li>Some features require the "ip" program. That program is generally included
|
||||
in the "iproute" package which should be included with your distribution
|
||||
(though many distributions don't install iproute by default). You
|
||||
may also download the latest source tarball from <a href="ftp://ftp.inr.ac.ru/ip-routing" target="_blank">
|
||||
ftp://ftp.inr.ac.ru/ip-routing</a>
|
||||
.<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">If you have <u>any</u> entry for a zone in /etc/shorewall/hosts then the
|
||||
.</li>
|
||||
<li>If you have <u>any</u> entry for a zone in /etc/shorewall/hosts then the
|
||||
zone must be entirely defined in /etc/shorewall/hosts unless you have
|
||||
specified MERGE_HOSTS=Yes (Shorewall version 1.3.5 and later). For example, if
|
||||
a zone has two interfaces but only one interface has an entry in /etc/shorewall/hosts
|
||||
then hosts attached to the other interface will <u>not</u> be considered
|
||||
part of the zone.<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="_themes/radial/aradbul1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="arial, Arial, Helvetica">Problems with NAT? Be sure that you let Shorewall add all external addresses
|
||||
part of the zone.</li>
|
||||
<li>Problems with NAT? Be sure that you let Shorewall add all external addresses
|
||||
to be use with NAT unless you have set <a href="Documentation.htm#Aliases">
|
||||
ADD_IP_ALIASES</a>
|
||||
=No in /etc/shorewall/shorewall.conf.<!--mstheme--></font><!--msthemelist--></td></tr>
|
||||
<!--msthemelist--></table><!--mstheme--><font face="arial, Arial, Helvetica">
|
||||
<h3><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Still Having Problems?<!--mstheme--></font></h3>
|
||||
=No in /etc/shorewall/shorewall.conf.</li>
|
||||
</ul>
|
||||
<h3>Still Having Problems?</h3>
|
||||
<p>See the<a href="support.htm"> support page.</a></p>
|
||||
|
||||
<font face="Century Gothic, Arial, Helvetica">
|
||||
@ -185,5 +190,5 @@ Tom Eastep</font>
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
<20> <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
|
||||
|
||||
<!--mstheme--></font></body>
|
||||
</body>
|
||||
</html>
|
||||
Reference in New Issue
Block a user