Re: Shorewall need clear to work after reboot
damjan--- via Shorewall-users <[email protected]> Tue, 13 Jan 2026 19:16:34 +0100
| Newsgroups | gmane.comp.security.shorewall |
|---|---|
| Message-ID | <[email protected]> |
This is a multipart message in MIME format. --===============1755481524244200956== Content-Type: multipart/alternative; boundary="----=_NextPart_000_00C7_01DC84C1.21E0FDE0" Content-Language: sl This is a multipart message in MIME format. ------=_NextPart_000_00C7_01DC84C1.21E0FDE0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi Did you also do this =C2=BBsystemctl enable shorewall=C2=AB =20 =20 From: Robert K Coffman Jr. -Info From Data Corp. = <[email protected]>=20 Sent: Tuesday, January 13, 2026 6:58 PM To: Shorewall Users <[email protected]> Subject: Re: [Shorewall-users] Shorewall need clear to work after reboot =20 Logging is too deep for me to go into here - on my system, there is a = shorewall-init log in /var/log. I suspect your system has this in = logcontrol. Here is the contents of the init.d job that starts shorewall on my = firewalls. For some changes to my configuration, I have to use this = script before shorewall start, or else the change doesn't work. I only = bring it up because perhaps the difference between = "/etc/init.d/shorewall start" and "shorewall start" could be used to fix = your problem. Strictly speculation however. #!/bin/sh RCDLINKS=3D"2,S19 3,S19 4,S19 5,S19 0,K91 6,K91" OPTIONS=3D"" WAIT_FOR_IFUP=3D/usr/share/shorewall/wait4ifup # Use /etc/default shorewall to specify $OPTIONS and STARTOPTIONS to # run at startup, however this this might prevent shorewall from # starting. use at your own risk if [ -f "/etc/default/shorewall" ] ; then . /etc/default/shorewall fi # wait for an unconfigured interface wait_for_pppd () { if [ "$wait_interface" !=3D "" ] then if [ -f $WAIT_FOR_IFUP ] then for i in $wait_interface do $WAIT_FOR_IFUP $i 60 done else echo "$WAIT_FOR_IFUP: File not found" exit 2 fi fi } start() { echo "Starting IPv4 shorewall rules..." wait_for_pppd [ -x /usr/sbin/mount_modules ] && /usr/sbin/mount_modules /sbin/shorewall $OPTIONS start $STARTOPTIONS [ -x /usr/sbin/umount_modules ] && /usr/sbin/umount_modules } stop() { echo "Stopping IPv4 shorewall rules..." /sbin/shorewall stop } refresh() { echo "Refreshing IPv4 shorewall rules..." /sbin/shorewall refresh $REFRESHOPTIONS } reload() { echo "Reloading IPv4 shorewall rules..." /sbin/shorewall reload $RELOADOPTIONS } restart() { echo "Restarting IPv4 shorewall rules..." [ -x /usr/sbin/mount_modules ] && /usr/sbin/mount_modules /sbin/shorewall restart $RESTARTOPTIONS [ -x /usr/sbin/umount_modules ] && /usr/sbin/umount_modules } status() { /sbin/shorewall status } case "$1" in 'start') start ;; 'stop') stop ;; 'refresh') refresh ;; 'reload') reload ;; 'restart') restart ;; 'status') status ;; *) echo "Usage: $0 = start|stop|refresh|reload|restart|status" ;; esac exit 0 # All done - Bob On 1/13/2026 11:36:39 AM, [email protected] <mailto:[email protected]> = wrote: Hi Robert, Do you mean shorewall show log or other? =20 Thx =20 El 2026-01-13 13:11, Robert K Coffman Jr. -Info From Data Corp. = escribi=C3=B3: Ok - what do the logs say after a reboot? One potential issue that = might cause this is the status of any interfaces that are required but = not ready when shorewall starts. On 1/13/2026 9:52:47 AM, [email protected] <mailto:[email protected]> = wrote: Hi Robert, =20 I'm using systemcl=20 =20 systemctl enable shorewall after install package. =20 Thx. =20 El 2026-01-13 10:30, Robert K Coffman Jr. -Info From Data Corp. = escribi=C3=B3: How are you starting Shorewall after a reboot? =20 On 1/13/2026 5:59:25 AM, rcortes--- via Shorewall-users wrote: Hi Simon,=20 i use shorewall from shorewall site reference, in this case 5.1.12 from = https://shorewall.org/pub/shorewall/5.1/shorewall-5.1.12/=20 and 5.2.8 from = https://www.invoca.ch/pub/packages/shorewall/RPMS/ils-7/noarch/=20 5.1.12 or 5.1.10 start but dont work, need apply clear/start to work.=20 5.2.8-12 start but dont work nat/dnat/proxyarp=20 Thx=20 El 2026-01-13 04:56, Simon Matter escribi=C3=B3:=20 Hi,=20 Hello everyone!=20 Somebody know why or how to fix shorewall for not need clear and start=20 after reboot? i have EL7 and shorewall 5.1.12, previously working with=20 5.1.10 and try with 5.2.8-12 but shorewall start but nat/dnat/proxyarp=20 dont work. Seems that your shorewall start is not working properly. Are you using a = shorewall package from epel? If so you could check the changelog to see=20 who has packaged it and ask directly?=20 Regards,=20 Simon _______________________________________________=20 Shorewall-users mailing list=20 [email protected] = <mailto:[email protected]> =20 https://lists.sourceforge.net/lists/listinfo/shorewall-users --=20 Robert K Coffman Jr. Info From Data Corp. 3307249000 [email protected] <mailto:[email protected]>=20 =20 _______________________________________________ Shorewall-users mailing list [email protected] = <mailto:[email protected]>=20 https://lists.sourceforge.net/lists/listinfo/shorewall-users --=20 Robert K Coffman Jr. Info From Data Corp. 3307249000 [email protected] <mailto:[email protected]>=20 =20 _______________________________________________ Shorewall-users mailing list [email protected] = <mailto:[email protected]>=20 https://lists.sourceforge.net/lists/listinfo/shorewall-users --=20 Robert K Coffman Jr. Info From Data Corp. 3307249000 [email protected] <mailto:[email protected]>=20 ------=_NextPart_000_00C7_01DC84C1.21E0FDE0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta = http-equiv=3DContent-Type content=3D"text/html; charset=3Dutf-8"><meta = name=3DGenerator content=3D"Microsoft Word 15 (filtered = medium)"><style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Consolas; panose-1:2 11 6 9 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; font-size:11.0pt; font-family:"Calibri",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} pre {mso-style-priority:99; mso-style-link:"HTML-oblikovano Znak"; margin:0cm; font-size:10.0pt; font-family:"Courier New";} span.HTML-oblikovanoZnak {mso-style-name:"HTML-oblikovano Znak"; mso-style-priority:99; mso-style-link:HTML-oblikovano; font-family:Consolas;} span.E-potniSlog21 {mso-style-type:personal-reply; font-family:"Calibri",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page WordSection1 {size:612.0pt 792.0pt; margin:70.85pt 70.85pt 70.85pt 70.85pt;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--></head><body lang=3DSL link=3Dblue = vlink=3Dpurple style=3D'word-wrap:break-word'><div = class=3DWordSection1><p class=3DMsoNormal><span = style=3D'mso-fareast-language:EN-US'>Hi<o:p></o:p></span></p><p = class=3DMsoNormal><span style=3D'mso-fareast-language:EN-US'>Did you = also do this =C2=BBsystemctl enable = shorewall=C2=AB<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'mso-fareast-language:EN-US'><o:p> </o:p></span></p><p = class=3DMsoNormal><span = style=3D'mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><di= v style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm = 0cm 0cm'><p class=3DMsoNormal><b>From:</b> Robert K Coffman Jr. -Info = From Data Corp. <[email protected]> <br><b>Sent:</b> = Tuesday, January 13, 2026 6:58 PM<br><b>To:</b> Shorewall Users = <[email protected]><br><b>Subject:</b> Re: = [Shorewall-users] Shorewall need clear to work after = reboot<o:p></o:p></p></div></div><p = class=3DMsoNormal><o:p> </o:p></p><p>Logging is too deep for me to = go into here - on my system, there is a shorewall-init log in = /var/log. I suspect your system has this in = logcontrol.<o:p></o:p></p><p>Here is the contents of the init.d job that = starts shorewall on my firewalls. For some changes to my = configuration, I have to use this script before shorewall start, or else = the change doesn't work. I only bring it up because perhaps the = difference between "/etc/init.d/shorewall start" and = "shorewall start" could be used to fix your problem. = Strictly speculation = however.<o:p></o:p></p><p>#!/bin/sh<br><br>RCDLINKS=3D"2,S19 3,S19 = 4,S19 5,S19 0,K91 = 6,K91"<br><br>OPTIONS=3D""<br><br>WAIT_FOR_IFUP=3D/usr/sha= re/shorewall/wait4ifup<br><br># Use /etc/default shorewall to specify = $OPTIONS and STARTOPTIONS to<br># run at startup, however this this = might prevent shorewall from<br># starting. use at your own risk<br>if [ = -f "/etc/default/shorewall" ] ; then<br> . = /etc/default/shorewall<br>fi<br><br># wait for an unconfigured = interface<br>wait_for_pppd () {<br> if [ = "$wait_interface" !=3D "" ]<br> = then<br> if [ -f = $WAIT_FOR_IFUP ]<br> = then<br> = for i in $wait_interface<br> = do<br> = $WAIT_FOR_IFUP $i 60<br> = done<br> = else<br> = echo "$WAIT_FOR_IFUP: File not found"<br> = exit 2<br> = fi<br> = fi<br>}<br><br><br>start() {<br> echo = "Starting IPv4 shorewall rules..."<br> = wait_for_pppd<br> [ -x = /usr/sbin/mount_modules ] && /usr/sbin/mount_modules<br> = /sbin/shorewall $OPTIONS start = $STARTOPTIONS<br> [ -x = /usr/sbin/umount_modules ] && = /usr/sbin/umount_modules<br>}<br><br>stop() {<br> = echo "Stopping IPv4 shorewall rules..."<br> = /sbin/shorewall stop<br>}<br><br>refresh() = {<br> echo "Refreshing IPv4 shorewall = rules..."<br> /sbin/shorewall refresh = $REFRESHOPTIONS<br>}<br><br><br>reload() {<br> = echo "Reloading IPv4 shorewall rules..."<br> = /sbin/shorewall reload = $RELOADOPTIONS<br>}<br><br>restart() {<br> = echo "Restarting IPv4 shorewall rules..."<br> = [ -x /usr/sbin/mount_modules ] && = /usr/sbin/mount_modules<br> /sbin/shorewall = restart $RESTARTOPTIONS<br> [ -x = /usr/sbin/umount_modules ] && = /usr/sbin/umount_modules<br>}<br><br>status() {<br> = /sbin/shorewall status<br>}<br><br>case "$1" = in<br> 'start')<br> = start<br> ;;<br> = 'stop')<br> = stop<br> ;;<br> = 'refresh')<br> = refresh<br> ;;<br> = 'reload')<br> = reload<br> ;;<br> = 'restart')<br> = restart<br> ;;<br> = 'status')<br> = status<br> ;;<br> *)<br> = echo "Usage: $0 = start|stop|refresh|reload|restart|status"<br> = ;;<br>esac<br><br>exit 0<br><br># All done<o:p></o:p></p><p>- = Bob<o:p></o:p></p><div><p class=3DMsoNormal>On 1/13/2026 11:36:39 AM, <a = href=3D"mailto:[email protected]">[email protected]</a> = wrote:<o:p></o:p></p></div><blockquote = style=3D'margin-top:5.0pt;margin-bottom:5.0pt'><p>Hi = Robert,<o:p></o:p></p><p>Do you mean shorewall show log or = other?<o:p></o:p></p><p><o:p> </o:p></p><p>Thx<o:p></o:p></p><p><o:p= > </o:p></p><p id=3Dreply-intro>El 2026-01-13 13:11, Robert K = Coffman Jr. -Info From Data Corp. = escribi=C3=B3:<o:p></o:p></p><blockquote = style=3D'border:none;border-left:solid #1010FF 1.5pt;padding:0cm 0cm 0cm = 5.0pt;margin-left:0cm;margin-right:0cm'><div id=3Dreplybody1><p>Ok - = what do the logs say after a reboot? One potential issue that = might cause this is the status of any interfaces that are required but = not ready when shorewall starts.<o:p></o:p></p><div><p = class=3DMsoNormal>On 1/13/2026 9:52:47 AM, <a = href=3D"mailto:[email protected]">[email protected]</a> = wrote:<o:p></o:p></p></div><blockquote = style=3D'border:none;border-left:solid #1010FF 1.5pt;padding:0cm 0cm 0cm = 5.0pt;margin-left:0cm;margin-right:0cm'><p>Hi = Robert,<o:p></o:p></p><p><o:p> </o:p></p><p>I'm using = systemcl <o:p></o:p></p><p><o:p> </o:p></p><p>systemctl enable = shorewall after install = package.<o:p></o:p></p><p><o:p> </o:p></p><p>Thx.<o:p></o:p></p><p><= o:p> </o:p></p><p id=3Dv1reply-intro>El 2026-01-13 10:30, Robert K = Coffman Jr. -Info From Data Corp. = escribi=C3=B3:<o:p></o:p></p><blockquote = style=3D'border:none;border-left:solid #1010FF 1.5pt;padding:0cm 0cm 0cm = 5.0pt;margin-left:0cm;margin-right:0cm'><div id=3Dv1replybody1><p>How = are you starting Shorewall after a = reboot?<o:p></o:p></p><p><o:p> </o:p></p><div><p = class=3DMsoNormal>On 1/13/2026 5:59:25 AM, rcortes--- via = Shorewall-users wrote:<o:p></o:p></p></div><blockquote = style=3D'border:none;border-left:solid #1010FF 1.5pt;padding:0cm 0cm 0cm = 5.0pt;margin-left:0cm;margin-right:0cm'><p class=3DMsoNormal>Hi Simon, = <br><br>i use shorewall from shorewall site reference, in this case = 5.1.12 from <a = href=3D"https://shorewall.org/pub/shorewall/5.1/shorewall-5.1.12/" = target=3D"_blank">https://shorewall.org/pub/shorewall/5.1/shorewall-5.1.1= 2/</a> <br>and 5.2.8 from <a = href=3D"https://www.invoca.ch/pub/packages/shorewall/RPMS/ils-7/noarch/" = target=3D"_blank">https://www.invoca.ch/pub/packages/shorewall/RPMS/ils-7= /noarch/</a> <br><br>5.1.12 or 5.1.10 start but dont work, need apply = clear/start to work. <br>5.2.8-12 start but dont work nat/dnat/proxyarp = <br><br>Thx <br><br>El 2026-01-13 04:56, Simon Matter escribi=C3=B3: = <o:p></o:p></p><blockquote style=3D'border:none;border-left:solid = #1010FF 1.5pt;padding:0cm 0cm 0cm = 5.0pt;margin-left:0cm;margin-right:0cm'><p class=3DMsoNormal = style=3D'margin-bottom:12.0pt'>Hi, <o:p></o:p></p><blockquote = style=3D'border:none;border-left:solid #1010FF 1.5pt;padding:0cm 0cm 0cm = 5.0pt;margin-left:0cm;margin-right:0cm'><p class=3DMsoNormal>Hello = everyone! <br><br>Somebody know why or how to fix shorewall for not need = clear and start <br>after reboot? i have EL7 and shorewall 5.1.12, = previously working with <br>5.1.10 and try with 5.2.8-12 but shorewall = start but nat/dnat/proxyarp <br>dont work.<o:p></o:p></p></blockquote><p = class=3DMsoNormal><br>Seems that your shorewall start is not working = properly. Are you using a <br>shorewall package from epel? If so you = could check the changelog to see <br>who has packaged it and ask = directly? <br><br>Regards, <br>Simon<o:p></o:p></p></blockquote><p = class=3DMsoNormal><br><br>_______________________________________________= <br>Shorewall-users mailing list <br><a = href=3D"mailto:[email protected]">Shorewall-users@lis= ts.sourceforge.net</a> <br><a = href=3D"https://lists.sourceforge.net/lists/listinfo/shorewall-users" = target=3D"_blank">https://lists.sourceforge.net/lists/listinfo/shorewall-= users</a><o:p></o:p></p></blockquote><pre>-- = <o:p></o:p></pre><pre>Robert K Coffman Jr.<o:p></o:p></pre><pre>Info = From Data Corp.<o:p></o:p></pre><pre>3307249000<o:p></o:p></pre><pre><a = href=3D"mailto:[email protected]">[email protected]</a><o:p= ></o:p></pre></div><p class=3DMsoNormal><o:p> </o:p></p><div><p = class=3DMsoNormal><span style=3D'font-family:"Courier = New"'>_______________________________________________<br>Shorewall-users = mailing list<br><a = href=3D"mailto:[email protected]">Shorewall-users@lis= ts.sourceforge.net</a><br><a = href=3D"https://lists.sourceforge.net/lists/listinfo/shorewall-users" = target=3D"_blank">https://lists.sourceforge.net/lists/listinfo/shorewall-= users</a><o:p></o:p></span></p></div></blockquote></blockquote><pre>-- = <o:p></o:p></pre><pre>Robert K Coffman Jr.<o:p></o:p></pre><pre>Info = From Data Corp.<o:p></o:p></pre><pre>3307249000<o:p></o:p></pre><pre><a = href=3D"mailto:[email protected]">[email protected]</a><o:p= ></o:p></pre></div><p class=3DMsoNormal><o:p> </o:p></p><div><p = class=3DMsoNormal><span style=3D'font-family:"Courier = New"'>_______________________________________________<br>Shorewall-users = mailing list<br><a = href=3D"mailto:[email protected]">Shorewall-users@lis= ts.sourceforge.net</a><br><a = href=3D"https://lists.sourceforge.net/lists/listinfo/shorewall-users" = target=3D"_blank">https://lists.sourceforge.net/lists/listinfo/shorewall-= users</a><o:p></o:p></span></p></div></blockquote></blockquote><pre>-- = <o:p></o:p></pre><pre>Robert K Coffman Jr.<o:p></o:p></pre><pre>Info = From Data Corp.<o:p></o:p></pre><pre>3307249000<o:p></o:p></pre><pre><a = href=3D"mailto:[email protected]">[email protected]</a><o:p= ></o:p></pre></div></body></html> ------=_NextPart_000_00C7_01DC84C1.21E0FDE0-- --===============1755481524244200956== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1755481524244200956== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline