Re: Errors when running firehol
Jason Miller <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.firehol.user |
|---|---|
| Message-ID | <[email protected]> |
On 16:26 Fri 23 Jan , Jason Miller wrote: > On 00:04 Sat 24 Jan , Phil Whineray wrote: > > On Fri, Jan 23, 2015 at 03:26:16PM -0800, Jason Miller wrote: > > > Hi Phil, > > > On 22:58 Fri 23 Jan , Phil Whineray wrote: > > > > Hi Jason > > > > > > > > On Fri, Jan 23, 2015 at 02:09:44PM -0800, Jason Miller wrote: > > > > > I got a lot of errors the first time I tried running firehol 2.0: > > > > > > > > > > > > > > > iptables: No chain/target/match by that name. > > > > > > > > Almost certainly your system does not have various iptables modules > > > > available to load. > > > This is what I thought initially too... > > > > > > > > What kind of system / distribution are you running? Are you using a > > > > distribution kernel or is it one you've built yourself? > > > I'm on gentoo, I built my kernel itself; I've got nearly every CONFIG_NF > > > option turned on though; do I need a newer kernel? I'm on 3.12.13: > > > > No, that should be more than adequate. I have machines running 3.3 > > through 3.16 without a similar problem. I haven't been rolling my own > > kernels, though. > > > > > CONFIG_NF_CONNTRACK=y > > ... > > > CONFIG_NF_CONNTRACK_FTP=y > > ... > > > CONFIG_NF_NAT_FTP=m > > > > It will likely turn out to be the same problem for all the errors, > > so lets concentrate on ftp as that comes first. > > > > Does the output of dmesg shed any light? > Nope, just the warning about automatic helper assignment being > deprecated > > > > Is the NAT module getting loaded? Are you using NAT? The FTP conntrack helper > > appears to be built in, perhaps try building it as a module? > Yes to NAT being loaded and being used. I'll retry FTP as a module, but > it takes about 30-40 minutes to build a kernel (It's ia 1.2GHz Via box), > so this will take a while to check. I finished trying this, and there was no change. > > > > Finally, I found this: https://dev.openwrt.org/ticket/13183 > > is automatic helper assignment somehow disabled in your kernel? I don't > > know what the implications of that would be. > Nope, I checked, and it's definitely enabled. > > > > Regards > > Phil > > > _______________________________________________ > Firehol-support mailing list > [email protected] > http://lists.firehol.org/mailman/listinfo/firehol-support >