On 12/04/2015 09:13 AM, Laurie Brown wrote: > On 04/12/15 16:42, Tom Eastep wrote: >> On 12/04/2015 08:03 AM, Laurie Brown wrote: >>> On 04/12/15 15:43, Tom Eastep wrote: >>> >>> [SNIP] >>> >>>> Please forward the compiled script. >>>> >>>> Thanks, >>>> -Tom >>> >>> See the attached file, Tom. Created with the 'shorewall compile' command. >>> >> >> This script is definitely different from the one used to create the >> trace you sent earlier. From that trace: >> >> ... >> + GATEWAYS= >> + local gateway >> + run_findgw_exit eth3 <=========== >> + true <=========== >> + gateway= >> + [ -z ] >> + ip addr list eth3 >> ... >> >> At that time, there was no 'findgw' script because the run_findgw_exit >> function simply returned 'true'. Please verify that the run_findgw_exit >> function in /var/lib/shorewall/firewall matches what you just sent. If >> it does not, then run 'shorewall compile' > > I'm confused now, because I've done nothing different... I'm also a bit > lost here as to how to make the comparison, so I just recompiled. Prior > to doing that I did this: > > # ls -al /var/lib/shorewall/firewall > -rwx------ 1 root root 86843 Nov 27 15:55 /var/lib/shorewall/firewall > > and it says November! > > Here's the situation afterwards: > > # ls -al /var/lib/shorewall/firewall > -rwx------ 1 root root 83629 Dec 4 17:00 /var/lib/shorewall/firewall > > Now there's a totally different error: > > # shorewall -vvvvvvv restart > Restarting Shorewall.... > ERROR: Can't determine the IP address of VIR_IF: Firewall state not > changed > Terminated > > This is my params file: > > ---- cut here ---- > LOC_IF=eth0 > DMZ_IF=eth1 > ECL_IF=eth2 > VIR_IF=eth3 > > ETH3_IP=$(find_first_interface_address eth3) > ---- cut here ---- > >> So now I need another trace: >> >> rm /var/lib/shorewall/eth3.status >> sh -x /var/lib/shorewall/firewall restart > trace 2>&1 >> >> Thanks, >> -Tom > > I've done two, the first one (trace1) is before I recompiled and using > the script from November, The second (trace2) is as of right now. > > The device eth3 is up and happy: > > ---- cut here ---- > eth3 Link encap:Ethernet HWaddr 00:30:18:a1:22:bd > inet addr:82.9.127.74 Bcast:255.255.255.255 Mask:255.255.252.0 > UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 > RX packets:2 errors:0 dropped:0 overruns:0 frame:0 > TX packets:2 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:1000 > RX bytes:716 (716.0 B) TX bytes:684 (684.0 B) > ---- cut here ---- > > # shorewall check > Checking... > Shorewall configuration verified > # shorewall -vvvvv restart > Restarting Shorewall.... > ERROR: Can't determine the IP address of VIR_IF: Firewall state not > changed > Terminated > > I'm totally confused here now! >
So am I. It appears that you have the following in your params file: DMZ_IF=eth1 ECL_IF=eth2 LOC_IF=eth0 VIR_IF=eth3 but you are using these names in your configuration without a leading '$'. Are you also defining them as logical names for the interfaces in /etc/shorewall/interfaces? If so, the old compiler that you are using isn't doing a proper job of translating them to their real names. Please tar up your /etc/shorewall directory and send the archive to me personally. Thanks, -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Go from Idea to Many App Stores Faster with Intel(R) XDK Give your users amazing mobile app experiences with Intel(R) XDK. Use one codebase in this all-in-one HTML5 development environment. Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs. http://pubads.g.doubleclick.net/gampad/clk?id=254741911&iu=/4140
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
