forked from extern/shorewall_code
fixed quotes, add CVS Id
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1008 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
mhnoyes
parent
ee5974bf57
commit
63779f4b9d
@ -3,6 +3,8 @@
|
||||
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||
<!-- $Id$ -->
|
||||
<article id="usefull_links">
|
||||
<!--$Id$-->
|
||||
|
||||
<articleinfo>
|
||||
<title>Shorewall Troubleshooting Guide</title>
|
||||
|
||||
@ -32,9 +34,9 @@
|
||||
|
||||
<graphic align="center" fileref="images/obrasinf.gif" />
|
||||
|
||||
<para><emphasis role="bold">"If you think you can you can; if you think
|
||||
you can't you're right. If you don't believe that you can, why
|
||||
should someone else?" -- Gunnar Tapper</emphasis> </para>
|
||||
<para><emphasis role="bold"><quote>If you think you can you can; if you
|
||||
think you can't you're right. If you don't believe that you can,
|
||||
why should someone else?</quote> -- Gunnar Tapper</emphasis></para>
|
||||
|
||||
<section>
|
||||
<title>First Steps</title>
|
||||
@ -59,15 +61,15 @@
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>"shorewall start" and "shorewall restart" Errors</title>
|
||||
<title><quote>shorewall start</quote> and <quote>shorewall restart</quote>
|
||||
Errors</title>
|
||||
|
||||
<para>If you receive an error message when starting or restarting the
|
||||
firewall and you can't determine the cause, then do the following:
|
||||
</para>
|
||||
firewall and you can't determine the cause, then do the following:</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>Make a note of the error message that you see. </para>
|
||||
<para>Make a note of the error message that you see.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
@ -96,8 +98,8 @@
|
||||
iptables: No chain/target/match by that name
|
||||
Terminated</programlisting>
|
||||
|
||||
<para>A search through the trace for "No chain/target/match by that
|
||||
name" turned up the following:</para>
|
||||
<para>A search through the trace for <quote>No chain/target/match by
|
||||
that name</quote> turned up the following:</para>
|
||||
|
||||
<programlisting> + echo 'Adding Common Rules'
|
||||
+ add_common_rules
|
||||
@ -108,10 +110,10 @@
|
||||
iptables: No chain/target/match by that name
|
||||
</programlisting>
|
||||
|
||||
<para>The command that failed was: "iptables -A reject -p tcp -j
|
||||
REJECT --reject-with tcp-reset". In this case, the user had compiled
|
||||
his own kernel and had forgotten to include REJECT target support (see
|
||||
<ulink url="kernel.htm">kernel.htm</ulink>) </para>
|
||||
<para>The command that failed was: <quote>iptables -A reject -p tcp -j
|
||||
REJECT --reject-with tcp-reset</quote>. In this case, the user had
|
||||
compiled his own kernel and had forgotten to include REJECT target
|
||||
support (see <ulink url="kernel.htm">kernel.htm</ulink>)</para>
|
||||
</example>
|
||||
</section>
|
||||
|
||||
@ -119,8 +121,7 @@
|
||||
<title>Your Network Environment</title>
|
||||
|
||||
<para>Many times when people have problems with Shorewall, the problem is
|
||||
actually an ill-conceived network setup. Here are several popular snafus:
|
||||
</para>
|
||||
actually an ill-conceived network setup. Here are several popular snafus:</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
@ -131,12 +132,12 @@
|
||||
<listitem>
|
||||
<para>Changing the IP address of a local system to be in the external
|
||||
subnet, thinking that Shorewall will suddenly believe that the system
|
||||
is in the 'net' zone.</para>
|
||||
is in the <quote>net</quote> zone.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Multiple interfaces connected to the same HUB or Switch. Given
|
||||
the way that the Linux kernel respond to ARP "who-has"
|
||||
the way that the Linux kernel respond to ARP <quote>who-has</quote>
|
||||
requests, this type of setup does NOT work the way that you expect it
|
||||
to. If you are running Shorewall version 1.4.7 or later, you can test
|
||||
using this kind of configuration if you specify the <emphasis
|
||||
@ -159,11 +160,11 @@
|
||||
|
||||
<para>I also recommend against setting all of your policies to ACCEPT in
|
||||
an effort to make something work. That robs you of one of your best
|
||||
diagnostic tools - the "Shorewall" messages that Netfilter will
|
||||
generate when you try to connect in a way that isn't permitted by your
|
||||
rule set.</para>
|
||||
diagnostic tools - the <quote>Shorewall</quote> messages that Netfilter
|
||||
will generate when you try to connect in a way that isn't permitted by
|
||||
your rule set.</para>
|
||||
|
||||
<para>Check your log ("/sbin/shorewall show log"). If you
|
||||
<para>Check your log (<quote>/sbin/shorewall show log</quote>). If you
|
||||
don't see Shorewall messages, then your problem is probably NOT a
|
||||
Shorewall problem. If you DO see packet messages, it may be an indication
|
||||
that you are missing one or more rules -- see <ulink url="FAQ.htm#faq17">FAQ
|
||||
@ -188,9 +189,8 @@
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>all2all:REJECT - This packet was REJECTed out of the all2all
|
||||
chain -- the packet was rejected under the
|
||||
"all"->"all" REJECT policy (see <ulink
|
||||
url="FAQ.htm#faq17">FAQ 17</ulink>).</para>
|
||||
chain -- the packet was rejected under the <quote>all</quote>-><quote>all</quote>
|
||||
REJECT policy (see <ulink url="FAQ.htm#faq17">FAQ 17</ulink>).</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
@ -218,8 +218,8 @@
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>In this case, 192.168.2.2 was in the "dmz" zone and
|
||||
192.168.1.3 is in the "loc" zone. I was missing the rule:</para>
|
||||
<para>In this case, 192.168.2.2 was in the <quote>dmz</quote> zone and
|
||||
192.168.1.3 is in the <quote>loc</quote> zone. I was missing the rule:</para>
|
||||
|
||||
<programlisting>ACCEPT dmz loc udp 53</programlisting>
|
||||
</example>
|
||||
@ -228,9 +228,9 @@
|
||||
<section>
|
||||
<title>Ping Problems</title>
|
||||
|
||||
<para> Either can't ping when you think you should be able to or are
|
||||
<para>Either can't ping when you think you should be able to or are
|
||||
able to ping when you think that you shouldn't be allowed?
|
||||
Shorewall's 'Ping' Management is <ulink url="ping.html">described
|
||||
Shorewall's <quote>Ping</quote> Management is <ulink url="ping.html">described
|
||||
here</ulink>.</para>
|
||||
</section>
|
||||
|
||||
@ -240,7 +240,7 @@
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>Seeing rejected/dropped packets logged out of the INPUT or
|
||||
FORWARD chains? This means that: </para>
|
||||
FORWARD chains? This means that:</para>
|
||||
|
||||
<orderedlist>
|
||||
<listitem>
|
||||
@ -262,12 +262,12 @@
|
||||
|
||||
<listitem>
|
||||
<para>Remember that Shorewall doesn't automatically allow ICMP
|
||||
type 8 ("ping") requests to be sent between zones. If you want
|
||||
pings to be allowed between zones, you need a rule of the form:</para>
|
||||
type 8 (<quote>ping</quote>) requests to be sent between zones. If you
|
||||
want pings to be allowed between zones, you need a rule of the form:</para>
|
||||
|
||||
<programlisting>    ACCEPT    <emphasis><source zone></emphasis>    <emphasis><destination zone></emphasis>    icmp    echo-request</programlisting>
|
||||
|
||||
<para> The ramifications of this can be subtle. For example, if you
|
||||
<para>The ramifications of this can be subtle. For example, if you
|
||||
have the following in <ulink url="NAT.htm">/etc/shorewall/nat</ulink>:</para>
|
||||
|
||||
<programlisting>    10.1.1.2    eth0    130.252.100.18</programlisting>
|
||||
@ -278,7 +278,7 @@
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>If you specify "routefilter" for an interface, that
|
||||
<para>If you specify <quote>routefilter</quote> for an interface, that
|
||||
interface must be up prior to starting the firewall.</para>
|
||||
</listitem>
|
||||
|
||||
@ -298,21 +298,20 @@
|
||||
<para>Some versions of LRP (EigerStein2Beta for example) have a shell
|
||||
with broken variable expansion. You can get a corrected shell from the
|
||||
<ulink url="ftp://ftp.shorewall.net/pub/shorewall/ash.gz">Shorewall
|
||||
Errata download site</ulink>. </para>
|
||||
Errata download site</ulink>.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Do you have your kernel properly configured? <ulink
|
||||
url="kernel.htm">Click here to see my kernel configuration</ulink>.
|
||||
</para>
|
||||
url="kernel.htm">Click here to see my kernel configuration</ulink>.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Shorewall requires the "ip" program. That program is
|
||||
generally included in the "iproute" package which should be
|
||||
included with your distribution (though many distributions don't
|
||||
install iproute by default). You may also download the latest source
|
||||
tarball from <ulink url="ftp://ftp.inr.ac.ru/ip-routing">ftp://ftp.inr.ac.ru/ip-routing</ulink>
|
||||
<para>Shorewall requires the <quote>ip</quote> program. That program
|
||||
is generally included in the <quote>iproute</quote> package which
|
||||
should be included with your distribution (though many distributions
|
||||
don't install iproute by default). You may also download the
|
||||
latest source tarball from <ulink url="ftp://ftp.inr.ac.ru/ip-routing">ftp://ftp.inr.ac.ru/ip-routing</ulink>
|
||||
.</para>
|
||||
</listitem>
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user