forked from extern/shorewall_code
Add Error Messages Article
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1665 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
a9339fc884
commit
31f0b2dc68
@ -15,7 +15,7 @@
|
||||
</author>
|
||||
</authorgroup>
|
||||
|
||||
<pubdate>2004-09-23</pubdate>
|
||||
<pubdate>2004-10-05</pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2001-2004</year>
|
||||
@ -296,6 +296,10 @@
|
||||
<para><ulink url="errata.htm">Errata</ulink></para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><ulink url="ErrorMessages.html">Error Messages</ulink></para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><ulink url="shorewall_extension_scripts.htm">Extension
|
||||
Scripts</ulink> (How to extend Shorewall without modifying Shorewall
|
||||
|
||||
505
Shorewall-docs2/ErrorMessages.xml
Normal file
505
Shorewall-docs2/ErrorMessages.xml
Normal file
@ -0,0 +1,505 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||
<article>
|
||||
<!--$Id$-->
|
||||
|
||||
<articleinfo>
|
||||
<title>Shorewall Error Messages</title>
|
||||
|
||||
<authorgroup>
|
||||
<author>
|
||||
<firstname>Tom</firstname>
|
||||
|
||||
<surname>Eastep</surname>
|
||||
</author>
|
||||
</authorgroup>
|
||||
|
||||
<pubdate>2004-10-06</pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2004</year>
|
||||
|
||||
<holder>Thomas M. Eastep</holder>
|
||||
</copyright>
|
||||
|
||||
<legalnotice>
|
||||
<para>Permission is granted to copy, distribute and/or modify this
|
||||
document under the terms of the GNU Free Documentation License, Version
|
||||
1.2 or any later version published by the Free Software Foundation; with
|
||||
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
||||
Texts. A copy of the license is included in the section entitled
|
||||
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
|
||||
License</ulink></quote>.</para>
|
||||
</legalnotice>
|
||||
</articleinfo>
|
||||
|
||||
<section>
|
||||
<title>Introduction</title>
|
||||
|
||||
<para>Shorewall can produce a wide variety of error messages when a
|
||||
problem is detected with your configuration. This article attempts to
|
||||
explain the cause of and cures for some of these messages.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Messages Produced by /sbin/shorewall</title>
|
||||
|
||||
<para>Some error messages are produced by the /sbin/shorewall utility.
|
||||
These messages are detailed in this section.</para>
|
||||
|
||||
<glosslist>
|
||||
<glossentry>
|
||||
<glossterm>ERROR: <label> must specify a simple file name:
|
||||
<name></glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>This means that you have specified a restore file name with a
|
||||
"/". Restore files must be simple file names with no slashes.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Shorewall is not properly installed</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The files <filename>/usr/share/shorewall/firewall</filename>
|
||||
and/or <filename>/usr/share/shorewall/version</filename> do not
|
||||
exist.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: <file name> exists and is not a saved
|
||||
Shorewall configuration</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The named file in <filename>/var/lib/shorewall</filename>
|
||||
exists but is not executable.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Reserved file name: <file name></glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>You have specified either <filename>save</filename> or
|
||||
<filename>restore-base</filename> as the name of a restore file --
|
||||
those names are reserved for use by Shorewall.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Currently-running Configuration Not
|
||||
Saved</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>During processing of a <command>shorewall save</command>
|
||||
command, the <command>iptables-save</command> command failed.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: /var/lib/shorewall/restore-base does not
|
||||
exist</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The <command>shorewall start</command> and <command>shorewall
|
||||
restart</command> commands create a file called
|
||||
<filename>/var/lib/shorewall/restore-base</filename> which forms the
|
||||
basis for creating a restore file using <command>shorewall
|
||||
save</command>. This error message is issued when <command>shorewall
|
||||
save</command> is not able to find that file.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
</glosslist>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Messages Produced by /usr/share/shorewall/firewall</title>
|
||||
|
||||
<para>The program <filename>/usr/share/shorewall/firewall</filename> is
|
||||
responsible for parsing the Shorewall configuration files and for creating
|
||||
and changing the Netfilter configuration. Some of the error messages
|
||||
generated by this program are listed below.</para>
|
||||
|
||||
<glosslist>
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Invalid zone definition for zone
|
||||
<zone></glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The zone named in the message is defined to be associated with
|
||||
an interface in <filename>/etc/shorewall/interfaces</filename> yet
|
||||
it also has an entry for that same interface in
|
||||
<filename>/etc/shorewall/hosts</filename>.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Invalid zone (<zone>) in record
|
||||
"<record>"</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The zone named in the ZONE column of the listed record from
|
||||
<filename>/etc/shorewall/interfaces</filename> or
|
||||
<filename>/etc/shorewall/hosts</filename> is not defined in
|
||||
<filename>/etc/shorewall/zones</filename>.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Duplicate Interface <interface></glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The named interface has two entries in
|
||||
<filename>/etc/shorewall/interfaces</filename>.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Invalid Interface Name:
|
||||
<interface></glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The interface name contains a colon (":") or is "+". If the
|
||||
name includes a ":", you probably need to read <ulink
|
||||
url="Shorewall_and_Aliased_Interfaces.xml">this
|
||||
article</ulink>.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Unknown interface (<interface>) in record
|
||||
"<record>"</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The <emphasis><interface></emphasis> name listed in the
|
||||
<emphasis><record></emphasis> from
|
||||
<filename>/etc/shorewall/hosts</filename> was not defined in
|
||||
<filename>/etc/shorewall/interfaces</filename>.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Bridged interfaces may not be defined in
|
||||
/etc/shorewall/interfaces:
|
||||
<interface>[:<address>]</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The named interface appears in /etc/shorewall/hosts and
|
||||
appears as a bridge port (after a colon) but is also defined in
|
||||
<filename>/etc/shorewall/interfaces</filename>.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Your kernel and/or iptables does not support policy
|
||||
match: ipsec</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>You have specified the <emphasis role="bold">ipsec</emphasis>
|
||||
option in an <filename>/etc/shorewall/hosts</filename> record but
|
||||
your kernel and/or iptables is missing policy match support. That
|
||||
support in turn requires a set of ipsec-netfilter patches in order
|
||||
to work correctly.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Undefined zone <zone></glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The named zone appears in the /etc/shorewall/policy file but
|
||||
not in the /etc/shorewall/zones file.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Can't determine the IP address of
|
||||
<interface></glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>You have specified DETECT_DNAT_ADDRS=Yes in
|
||||
/etc/shorewall/shorewall.conf and Shorewall is unablee to determine
|
||||
the IP address of the named <emphasis><interface></emphasis>.
|
||||
Be sure that the interface is started before starting Shorewall or
|
||||
set DETECT_DNAT_ADDRS=No.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Invalid gateway zone (<zone>) -- Tunnel
|
||||
"<record></glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The listed <emphasis><zone></emphasis> name appears in
|
||||
the GATEWAY ZONE column of the listed
|
||||
<emphasis><record></emphasis> from
|
||||
<filename>/etc/shorewall/tunnels</filename> but is not defined in
|
||||
<filename>/etc/shorewall/zones</filename>.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Your kernel and/or iptables does not support policy
|
||||
match</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>Your /etc/shorewall/ipsec file is non-empty but your kernel
|
||||
and/or iptables do not include policy match support. That support in
|
||||
turn requires a set of ipsec-netfilter patches in order to work
|
||||
correctly.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: No hosts on <interface> have the maclist
|
||||
option specified</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The named <emphasis><interface></emphasis> appears in a
|
||||
record in <filename>/etc/shorewall/maclist</filename> yet that
|
||||
interface's record in <filename>/etc/shorewall/interfaces</filename>
|
||||
does not specify the <emphasis role="bold">maclist</emphasis> option
|
||||
and no record in <filename>/etc/shorewall/hosts</filename> that
|
||||
names that interface includes the <emphasis
|
||||
role="bold">maclist</emphasis> option.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Interface <interface> must be up before
|
||||
Shorewall can start</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>You have specified the <emphasis
|
||||
role="bold">maclist</emphasis> option for this interface but the
|
||||
command <command>ip list show <interface></command>
|
||||
fails.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Unknown interface <interface></glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The interface appears in a configuration file but is not
|
||||
defined in <filename>/etc/shorewall/interfaces</filename>.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: BRIDGING=Yes requires Physdev Match support in your
|
||||
Kernel and iptables</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>You have set BRIDGING=Yes in
|
||||
<filename>/etc/shorewall/shorewall.conf</filename> but it appears
|
||||
that your kernel and/or iptables do not have physdev match
|
||||
support.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Unknown interface <interface> in rule:
|
||||
"<rule>"</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>You have BRIDGING=No in
|
||||
<filename>/etc/shorewall/shorewall.conf</filename> and the
|
||||
<emphasis><interface></emphasis> given in a rule does not
|
||||
match an entry in
|
||||
<filename>/etc/shorewall/interfaces</filename>.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: SNAT may no longer be specified in a DNAT rule; use
|
||||
/etc/shorewall/masq instead</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>In earlier Shorewall versions, the ORIGINAL DEST column
|
||||
allowed following the original destination IP address with ":" and
|
||||
an address to use as the source of the forwarded connection request.
|
||||
Now that /etc/shorewall/masq supports qualification of SNAT rules by
|
||||
protocol and port, this feature is no longer required and has been
|
||||
deimplemented.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: "Invalid Source in rule "<rule>"</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The SOURCE column has the firewall zone name immediately
|
||||
followed by "!". This syntax is use to exclude a subzone and
|
||||
Shorewall currently doesn't support subzones of the firewall
|
||||
zone.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Rule "<rule>" - Destination may not be
|
||||
specified by MAC Address</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>Netfilter (and hence Shorewall) does not allow qualification
|
||||
of a rule by destination source IP address.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Destination interface not allowed with
|
||||
<action></glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The named <emphasis><action></emphasis> will be ACCEPT+
|
||||
or NONAT. These actions are inforced in part in the PREROUTING nat
|
||||
chain where the destination interface is not yet known (because the
|
||||
packet has not yet been routed). As a result, the DESTINATION column
|
||||
may not contain an interface name.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Only DNAT and REDIRECT rules may specify destination
|
||||
mapping; rule "<rule>"</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The <emphasis><rule></emphasis> specifies a server
|
||||
address that is different from the ORIGINAL DEST address and/or it
|
||||
specifies a server port that is different from the destination port
|
||||
but the ACTION is neither DNAT[-] nor REJECT[-].</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Empty source zone or qualifier: rule
|
||||
"<rule>"</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The SOURCE column is of one of the forms
|
||||
<emphasis><zone></emphasis>:,
|
||||
:<emphasis><qualifier></emphasis> or :.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Exclude list only allowed with DNAT or
|
||||
REDIRECT</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>In DNAT[-] and REDIRECT[-] rules, you can have a SOURCE of the
|
||||
form
|
||||
<emphasis><zone></emphasis>:<emphasis><net1></emphasis>!<emphasis><net2></emphasis>.
|
||||
This means <emphasis><net1></emphasis> in the
|
||||
<emphasis><zone></emphasis> zone <emphasis role="bold">except
|
||||
for</emphasis> <emphasis><net2></emphasis>. This syntax is not
|
||||
available with other ACTIONs.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Invalid use of a user-qualification: rule
|
||||
"<rule>"</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The USER/GROUP column may only have and entry if the SOURCE is
|
||||
the firewall zone.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Empty destination zone or qualifier: rule
|
||||
"<rule>"</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The DEST column is of one of the forms
|
||||
<emphasis><zone></emphasis>:,
|
||||
:<emphasis><qualifier></emphasis> or :.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Undefined Client Zone in rule
|
||||
"<rule>"</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The zone given in the SOURCE column was not defined in
|
||||
<filename>/etc/shorewall/zones</filename>.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Undefined Server Zone in rule
|
||||
"<rule>"</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The zone given in the DEST column was not defined in
|
||||
<filename>/etc/shorewall/zones</filename>.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Rules may not override a NONE policy: rule
|
||||
"<rule>"</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>If the policy from zone z1 to zone z2 is NONE that means that
|
||||
Shorewall sets up no infrastructure to handle traffic from z1 to z2.
|
||||
Consequently, you cannot have any rules that control traffic from z1
|
||||
to z2.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Invalid Action in rule "<rule>"</glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>The ACTION column contains an action that is not one of the
|
||||
built-in actions and it is not defined in
|
||||
<filename>/etc/shorewall/actions</filename> or in
|
||||
<filename>/usr/share/shorewall/actions.std</filename>.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
|
||||
<glossentry>
|
||||
<glossterm>ERROR: Unable to determine the routes through interface
|
||||
<interface></glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>You have specified <emphasis><interface></emphasis> in
|
||||
the SUBNET column of <filename>/etc/shorewall/masq</filename> which
|
||||
means that Shorewall is supposed to determine the network(s) routed
|
||||
through that interface. To do that, Shorewall issues the command
|
||||
<command>ip addr ls dev <interface></command> and that command
|
||||
failed. This usually means that you are trying to start Shorewall
|
||||
before the <emphasis><interface></emphasis> is brought
|
||||
up.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
</glosslist>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Warnings</title>
|
||||
|
||||
<para>This sections describes some of the more warnings generated by
|
||||
Shorewall.</para>
|
||||
|
||||
<glosslist>
|
||||
<glossentry>
|
||||
<glossterm>Warning: default route ignored on interface
|
||||
<interface></glossterm>
|
||||
|
||||
<glossdef>
|
||||
<para>This means that the interface named in the SUBNET column of
|
||||
<filename>/etc/shorewall/masq</filename> has the default route. This
|
||||
almost always means that you have the contents of the INTERFACE and
|
||||
SUBNET columns reversed.</para>
|
||||
</glossdef>
|
||||
</glossentry>
|
||||
</glosslist>
|
||||
</section>
|
||||
</article>
|
||||
Loading…
Reference in New Issue
Block a user