diff --git a/docs/FAQ.xml b/docs/FAQ.xml index 46e0d9445..8692f6c4a 100644 --- a/docs/FAQ.xml +++ b/docs/FAQ.xml @@ -2090,6 +2090,57 @@ shorewall status > /dev/null 2>&1 || shorewall start # Start Shorewall /etc/shorewall/params when processing the restore command. + +
+ (FAQ 90) Shorewall starts fine but after several minutes, it + stops. Why is it doing that? + + Answer: Shorewall uses the + presence of a chain named shorewall to indicate + whether is started or stopped. That chain is created during execution of + a successful start, restart or restore command and is removed during stop and clear. + If shorewall status indicates that + Shorewall is stopped, then something has deleted that chain. Look at the + output of shorewall status; if it looks + like this: + +
+ gateway:~# shorewall status +Shorewall-4.4.11 Status at gateway - Wed Jul 21 13:21:41 PDT 2010 + +Shorewall is stopped +State:Started (Tue Jul 20 16:01:49 PDT 2010) + +gateway:~# + +
+ + then it means that somehing outside of Shorewall has deleted the + chain. This usually means that you were running another firewall package + before you installed Shorewall and that other package has replaced + Shorewall's Netfilter configuration with its own. You must remove (or at + least disable) the other firewall package and restart Shorewall. + +
+ gateway:~# shorewall status +Shorewall-4.4.11 Status at gateway - Wed Jul 21 13:26:29 PDT 2010 + +Shorewall is stopped +State:Stopped (Wed Jul 21 13:26:26 PDT 2010) + +gateway:~# +
+ + then a shorewall stop command has + been executed (if the State shown in the output is Cleared, then a shorewall + clear command was executed). Most likely, you have installed + and configured the shorewall-init package and a + required interface has gone down. +
@@ -2326,7 +2377,7 @@ We have an error talking to the kernel Answer: Beginning with Shorewall 4.4.11 Beta 2, you can create vserver - zones that are nested within the firewall zone. + zones that are nested within the firewall zone. Prior to 4.4.11 Beta 2, there is no way to create sub-zones of the firewall zone. But you can use shell variables to make vservers easier