Re: Shorewall need clear to work after reboot
"Robert K Coffman Jr. -Info From Data Corp." <[email protected]> Tue, 13 Jan 2026 12:57:45 -0500
| Newsgroups | gmane.comp.security.shorewall |
|---|---|
| Organization | Info From Data Corporation |
| Message-ID | <[email protected]> |
--===============3068809921579223796==
Content-Language: en-US
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Logging is too deep for me to go into here - on my system, there
is a shorewall-init log in /var/log. I suspect your system has
this in logcontrol.</p>
<p>Here is the contents of the init.d job that starts shorewall on
my firewalls. For some changes to my configuration, I have to use
this script before shorewall start, or else the change doesn't
work. I only bring it up because perhaps the difference between
"/etc/init.d/shorewall start" and "shorewall start" could be used
to fix your problem. Strictly speculation however.</p>
<p>#!/bin/sh<br>
<br>
RCDLINKS="2,S19 3,S19 4,S19 5,S19 0,K91 6,K91"<br>
<br>
OPTIONS=""<br>
<br>
WAIT_FOR_IFUP=/usr/share/shorewall/wait4ifup<br>
<br>
# Use /etc/default shorewall to specify $OPTIONS and STARTOPTIONS
to<br>
# run at startup, however this this might prevent shorewall from<br>
# starting. use at your own risk<br>
if [ -f "/etc/default/shorewall" ] ; then<br>
. /etc/default/shorewall<br>
fi<br>
<br>
# wait for an unconfigured interface<br>
wait_for_pppd () {<br>
if [ "$wait_interface" != "" ]<br>
then<br>
if [ -f $WAIT_FOR_IFUP ]<br>
then<br>
for i in $wait_interface<br>
do<br>
$WAIT_FOR_IFUP $i 60<br>
done<br>
else<br>
echo "$WAIT_FOR_IFUP: File not found"<br>
exit 2<br>
fi<br>
fi<br>
}<br>
<br>
<br>
start() {<br>
echo "Starting IPv4 shorewall rules..."<br>
wait_for_pppd<br>
[ -x /usr/sbin/mount_modules ] &&
/usr/sbin/mount_modules<br>
/sbin/shorewall $OPTIONS start $STARTOPTIONS<br>
[ -x /usr/sbin/umount_modules ] &&
/usr/sbin/umount_modules<br>
}<br>
<br>
stop() {<br>
echo "Stopping IPv4 shorewall rules..."<br>
/sbin/shorewall stop<br>
}<br>
<br>
refresh() {<br>
echo "Refreshing IPv4 shorewall rules..."<br>
/sbin/shorewall refresh $REFRESHOPTIONS<br>
}<br>
<br>
<br>
reload() {<br>
echo "Reloading IPv4 shorewall rules..."<br>
/sbin/shorewall reload $RELOADOPTIONS<br>
}<br>
<br>
restart() {<br>
echo "Restarting IPv4 shorewall rules..."<br>
[ -x /usr/sbin/mount_modules ] &&
/usr/sbin/mount_modules<br>
/sbin/shorewall restart $RESTARTOPTIONS<br>
[ -x /usr/sbin/umount_modules ] &&
/usr/sbin/umount_modules<br>
}<br>
<br>
status() {<br>
/sbin/shorewall status<br>
}<br>
<br>
case "$1" in<br>
'start')<br>
start<br>
;;<br>
'stop')<br>
stop<br>
;;<br>
'refresh')<br>
refresh<br>
;;<br>
'reload')<br>
reload<br>
;;<br>
'restart')<br>
restart<br>
;;<br>
'status')<br>
status<br>
;;<br>
*)<br>
echo "Usage: $0
start|stop|refresh|reload|restart|status"<br>
;;<br>
esac<br>
<br>
exit 0<br>
<br>
# All done<br>
</p>
<p>- Bob</p>
<div class="moz-cite-prefix">On 1/13/2026 11:36:39 AM,
<a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> wrote:<br>
</div>
<blockquote type="cite"
cite="mid:[email protected]">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<p>Hi Robert,</p>
<p>Do you mean shorewall show log or other?</p>
<p><br>
</p>
<p>Thx</p>
<p><br>
</p>
<p id="reply-intro">El 2026-01-13 13:11, Robert K Coffman Jr.
-Info From Data Corp. escribió:</p>
<blockquote type="cite"
style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<div id="replybody1">
<p>Ok - what do the logs say after a reboot? One potential
issue that might cause this is the status of any interfaces
that are required but not ready when shorewall starts.</p>
<div class="v1moz-cite-prefix">On 1/13/2026 9:52:47 AM, <a
class="v1moz-txt-link-abbreviated moz-txt-link-freetext"
href="mailto:[email protected]" rel="noreferrer"
moz-do-not-send="true">[email protected]</a> wrote:</div>
<blockquote type="cite"
style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<p>Hi Robert,</p>
<p><br>
</p>
<p>I'm using systemcl </p>
<p><br>
</p>
<p>systemctl enable shorewall after install package.</p>
<p><br>
</p>
<p>Thx.</p>
<p><br>
</p>
<p id="v1reply-intro">El 2026-01-13 10:30, Robert K Coffman
Jr. -Info From Data Corp. escribió:</p>
<blockquote
style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0;">
<div id="v1replybody1">
<p>How are you starting Shorewall after a reboot?</p>
<p><br>
</p>
<div class="v1v1moz-cite-prefix">On 1/13/2026 5:59:25
AM, rcortes--- via Shorewall-users wrote:</div>
<blockquote
style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0;">Hi
Simon, <br>
<br>
i use shorewall from shorewall site reference, in this
case 5.1.12 from <a
class="v1v1moz-txt-link-freetext v1moz-txt-link-freetext moz-txt-link-freetext"
href="https://shorewall.org/pub/shorewall/5.1/shorewall-5.1.12/"
target="_blank" rel="noopener noreferrer"
moz-do-not-send="true">https://shorewall.org/pub/shorewall/5.1/shorewall-5.1.12/</a>
<br>
and 5.2.8 from <a
class="v1v1moz-txt-link-freetext v1moz-txt-link-freetext moz-txt-link-freetext"
href="https://www.invoca.ch/pub/packages/shorewall/RPMS/ils-7/noarch/"
target="_blank" rel="noopener noreferrer"
moz-do-not-send="true">https://www.invoca.ch/pub/packages/shorewall/RPMS/ils-7/noarch/</a>
<br>
<br>
5.1.12 or 5.1.10 start but dont work, need apply
clear/start to work. <br>
5.2.8-12 start but dont work nat/dnat/proxyarp <br>
<br>
Thx <br>
<br>
El 2026-01-13 04:56, Simon Matter escribió: <br>
<blockquote
style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0;">Hi,
<br>
<br>
<blockquote
style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0;">Hello
everyone! <br>
<br>
Somebody know why or how to fix shorewall for not
need clear and start <br>
after reboot? i have EL7 and shorewall 5.1.12,
previously working with <br>
5.1.10 and try with 5.2.8-12 but shorewall start
but nat/dnat/proxyarp <br>
dont work.</blockquote>
<br>
Seems that your shorewall start is not working
properly. Are you using a <br>
shorewall package from epel? If so you could check
the changelog to see <br>
who has packaged it and ask directly? <br>
<br>
Regards, <br>
Simon</blockquote>
<br>
<br>
_______________________________________________ <br>
Shorewall-users mailing list <br>
<a
class="v1v1moz-txt-link-abbreviated v1moz-txt-link-freetext moz-txt-link-freetext"
href="mailto:[email protected]"
rel="noreferrer" moz-do-not-send="true">[email protected]</a>
<br>
<a
class="v1v1moz-txt-link-freetext v1moz-txt-link-freetext moz-txt-link-freetext"
href="https://lists.sourceforge.net/lists/listinfo/shorewall-users"
target="_blank" rel="noopener noreferrer"
moz-do-not-send="true">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a></blockquote>
<pre class="v1v1moz-signature">--
Robert K Coffman Jr.
Info From Data Corp.
3307249000
<a
class="v1v1moz-txt-link-abbreviated v1moz-txt-link-freetext moz-txt-link-freetext"
href="mailto:[email protected]" rel="noreferrer"
moz-do-not-send="true">[email protected]</a></pre>
</div>
<br>
<div class="v1pre"
style="margin: 0; padding: 0; font-family: monospace;">_______________________________________________<br>
Shorewall-users mailing list<br>
<a class="v1moz-txt-link-freetext moz-txt-link-freetext"
href="mailto:[email protected]"
rel="noreferrer" moz-do-not-send="true">[email protected]</a><br>
<a class="v1moz-txt-link-freetext moz-txt-link-freetext"
href="https://lists.sourceforge.net/lists/listinfo/shorewall-users"
target="_blank" rel="noopener noreferrer"
moz-do-not-send="true">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a></div>
</blockquote>
</blockquote>
<pre class="v1moz-signature">--
Robert K Coffman Jr.
Info From Data Corp.
3307249000
<a class="v1moz-txt-link-abbreviated moz-txt-link-freetext"
href="mailto:[email protected]" rel="noreferrer"
moz-do-not-send="true">[email protected]</a></pre>
</div>
<br>
<div class="pre"
style="margin: 0; padding: 0; font-family: monospace">_______________________________________________<br>
Shorewall-users mailing list<br>
<a href="mailto:[email protected]"
moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a><br>
<a
href="https://lists.sourceforge.net/lists/listinfo/shorewall-users"
target="_blank" rel="noopener noreferrer"
moz-do-not-send="true" class="moz-txt-link-freetext">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a></div>
</blockquote>
</blockquote>
<pre class="moz-signature" cols="72">--
Robert K Coffman Jr.
Info From Data Corp.
3307249000
<a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a></pre>
</body>
</html>
--===============3068809921579223796==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============3068809921579223796==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline