Re: Shorewall need clear to work after reboot
rcortes--- via Shorewall-users <[email protected]> Tue, 13 Jan 2026 16:22:56 -0300
| Newsgroups | gmane.comp.security.shorewall |
|---|---|
| Message-ID | <[email protected]> |
--===============3050533344766807464== Content-Type: multipart/alternative; boundary="=_b55595e89791338cfbd4e7c0bf310671" --=_b55595e89791338cfbd4e7c0bf310671 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8; format=flowed correct!! start but dont work after reboot. El 2026-01-13 15:16, damjan--- via Shorewall-users escribió: > Hi > > Did you also do this »systemctl enable shorewall« > > From: Robert K Coffman Jr. -Info From Data Corp. > <[email protected]> > Sent: Tuesday, January 13, 2026 6:58 PM > To: Shorewall Users <[email protected]> > Subject: Re: [Shorewall-users] Shorewall need clear to work after > reboot > > Logging is too deep for me to go into here - on my system, there is a > shorewall-init log in /var/log. I suspect your system has this in > logcontrol. > > Here is the contents of the init.d job that starts shorewall on my > firewalls. For some changes to my configuration, I have to use this > script before shorewall start, or else the change doesn't work. I only > bring it up because perhaps the difference between > "/etc/init.d/shorewall start" and "shorewall start" could be used to > fix your problem. Strictly speculation however. > > #!/bin/sh > > RCDLINKS="2,S19 3,S19 4,S19 5,S19 0,K91 6,K91" > > OPTIONS="" > > WAIT_FOR_IFUP=/usr/share/shorewall/wait4ifup > > # Use /etc/default shorewall to specify $OPTIONS and STARTOPTIONS to > # run at startup, however this this might prevent shorewall from > # starting. use at your own risk > if [ -f "/etc/default/shorewall" ] ; then > . /etc/default/shorewall > fi > > # wait for an unconfigured interface > wait_for_pppd () { > if [ "$wait_interface" != "" ] > then > if [ -f $WAIT_FOR_IFUP ] > then > for i in $wait_interface > do > $WAIT_FOR_IFUP $i 60 > done > else > echo "$WAIT_FOR_IFUP: File not found" > exit 2 > fi > fi > } > > start() { > echo "Starting IPv4 shorewall rules..." > wait_for_pppd > [ -x /usr/sbin/mount_modules ] && /usr/sbin/mount_modules > /sbin/shorewall $OPTIONS start $STARTOPTIONS > [ -x /usr/sbin/umount_modules ] && /usr/sbin/umount_modules > } > > stop() { > echo "Stopping IPv4 shorewall rules..." > /sbin/shorewall stop > } > > refresh() { > echo "Refreshing IPv4 shorewall rules..." > /sbin/shorewall refresh $REFRESHOPTIONS > } > > reload() { > echo "Reloading IPv4 shorewall rules..." > /sbin/shorewall reload $RELOADOPTIONS > } > > restart() { > echo "Restarting IPv4 shorewall rules..." > [ -x /usr/sbin/mount_modules ] && /usr/sbin/mount_modules > /sbin/shorewall restart $RESTARTOPTIONS > [ -x /usr/sbin/umount_modules ] && /usr/sbin/umount_modules > } > > status() { > /sbin/shorewall status > } > > case "$1" in > 'start') > start > ;; > 'stop') > stop > ;; > 'refresh') > refresh > ;; > 'reload') > reload > ;; > 'restart') > restart > ;; > 'status') > status > ;; > *) > echo "Usage: $0 start|stop|refresh|reload|restart|status" > ;; > esac > > exit 0 > > # All done > > - Bob > > On 1/13/2026 11:36:39 AM, [email protected] wrote: > > Hi Robert, > > Do you mean shorewall show log or other? > > Thx > > El 2026-01-13 13:11, Robert K Coffman Jr. -Info From Data Corp. > escribió: > > Ok - what do the logs say after a reboot? One potential issue that > might cause this is the status of any interfaces that are required but > not ready when shorewall starts. > > On 1/13/2026 9:52:47 AM, [email protected] wrote: > > Hi Robert, > > I'm using systemcl > > systemctl enable shorewall after install package. > > Thx. > > El 2026-01-13 10:30, Robert K Coffman Jr. -Info From Data Corp. > escribió: > > How are you starting Shorewall after a reboot? > > On 1/13/2026 5:59:25 AM, rcortes--- via Shorewall-users wrote: > > Hi Simon, > > i use shorewall from shorewall site reference, in this case 5.1.12 from > https://shorewall.org/pub/shorewall/5.1/shorewall-5.1.12/ > and 5.2.8 from > https://www.invoca.ch/pub/packages/shorewall/RPMS/ils-7/noarch/ > > 5.1.12 or 5.1.10 start but dont work, need apply clear/start to work. > 5.2.8-12 start but dont work nat/dnat/proxyarp > > Thx > > El 2026-01-13 04:56, Simon Matter escribió: > > Hi, > > Hello everyone! > > Somebody know why or how to fix shorewall for not need clear and start > after reboot? i have EL7 and shorewall 5.1.12, previously working with > 5.1.10 and try with 5.2.8-12 but shorewall start but nat/dnat/proxyarp > dont work. > > Seems that your shorewall start is not working properly. Are you using > a > shorewall package from epel? If so you could check the changelog to see > who has packaged it and ask directly? > > Regards, > Simon _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users -- Robert K Coffman Jr. Info From Data Corp. 3307249000 [email protected] _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users -- Robert K Coffman Jr. Info From Data Corp. 3307249000 [email protected] _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users -- Robert K Coffman Jr. Info From Data Corp. 3307249000 [email protected] _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users --=_b55595e89791338cfbd4e7c0bf310671 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=UTF-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset= =3DUTF-8" /></head><body style=3D'font-size: 10pt; font-family: Verdana,Gen= eva,sans-serif'> <p>correct!! start but dont work after reboot.</p> <div id=3D"signature"></div> <p><br /></p> <p id=3D"reply-intro">El 2026-01-13 15:16, damjan--- via Shorewall-users es= cribió:</p> <blockquote type=3D"cite" style=3D"padding: 0 0.4em; border-left: #1010ff 2= px solid; margin: 0"> <style type=3D"text/css">@font-face { font-family: "Cambria Math"; } @font-face { font-family: Calibri; } @font-face { font-family: Consolas; } #replybody1 p.v1MsoNormal, #replybody1 li.v1MsoNormal, #replybody1 div.v1Ms= oNormal { margin: 0cm; font-size: 11.0pt; font-family: "Calibri",sans-serif; } #replybody1 a:link, #replybody1 span.v1MsoHyperlink { mso-style-priority: 99; color: blue; text-decoration: underline; } #replybody1 pre { mso-style-priority: 99; mso-style-link: "HTML-oblikovano Znak"; margin: = 0cm; font-size: 10.0pt; font-family: "Courier New"; } #replybody1 span.v1HTML-oblikovanoZnak { mso-style-name: "HTML-oblikovano Znak"; mso-style-priority: 99; mso-styl= e-link: HTML-oblikovano; font-family: Consolas; } #replybody1 span.v1E-potniSlog21 { mso-style-type: personal-reply; font-family: "Calibri",sans-serif; color= : windowtext; } #replybody1 .v1MsoChpDefault { mso-style-type: export-only; font-size: 10.0pt; } @page WordSection1 { size: 612.0pt 792.0pt; margin: 70.85pt 70.85pt 70.85pt 70.85pt; } #replybody1 div.v1WordSection1 {}</style> <div id=3D"replybody1" lang=3D"SL" style=3D"word-wrap: break-word;"> <div class=3D"v1WordSection1"> <p class=3D"v1MsoNormal"><span style=3D"mso-fareast-language: EN-US;">Hi</s= pan></p> <p class=3D"v1MsoNormal"><span style=3D"mso-fareast-language: EN-US;">Did y= ou also do this »systemctl enable shorewall«</span></p> <p class=3D"v1MsoNormal"><span style=3D"mso-fareast-language: EN-US;"> = ;</span></p> <p class=3D"v1MsoNormal"><span style=3D"mso-fareast-language: EN-US;"> = ;</span></p> <div> <div style=3D"border: none; border-top: solid #E1E1E1 1.0pt; padding: 3.0pt= 0cm 0cm 0cm;"> <p class=3D"v1MsoNormal"><strong>From:</strong> Robert K Coffman Jr. -Info = From Data Corp. <[email protected]> <br /><strong>Sent:</stro= ng> Tuesday, January 13, 2026 6:58 PM<br /><strong>To:</strong> Shorewall U= sers <[email protected]><br /><strong>Subject:</s= trong> Re: [Shorewall-users] Shorewall need clear to work after reboot</p> </div> </div> <p class=3D"v1MsoNormal"> </p> <p>Logging is too deep for me to go into here - on my system, there is a sh= orewall-init log in /var/log. I suspect your system has this in logco= ntrol.</p> <p>Here is the contents of the init.d job that starts shorewall on my firew= alls. For some changes to my configuration, I have to use this script= before shorewall start, or else the change doesn't work. I only brin= g it up because perhaps the difference between "/etc/init.d/shorewall start= " and "shorewall start" could be used to fix your problem. Strictly s= peculation however.</p> <p>#!/bin/sh<br /><br />RCDLINKS=3D"2,S19 3,S19 4,S19 5,S19 0,K91 6,K91"<br= /><br />OPTIONS=3D""<br /><br />WAIT_FOR_IFUP=3D/usr/share/shorewall/wait4= ifup<br /><br /># Use /etc/default shorewall to specify $OPTIONS and STARTO= PTIONS to<br /># run at startup, however this this might prevent shorewall = from<br /># starting. use at your own risk<br />if [ -f "/etc/default/shore= wall" ] ; then<br /> . /etc/default/shorewall<br />fi<br /><br= /># wait for an unconfigured interface<br />wait_for_pppd () {<br /> = if [ "$wait_interface" !=3D "" ]<br /> &= nbsp; then<br /> if [ -f $WA= IT_FOR_IFUP ]<br /> then<br /> = ; for i in $wait_interface= <br /> do<br /> = ; &nb= sp; $WAIT_FOR_IFUP $i 60<br /> &nb= sp; done<br /> else<br />&nb= sp; echo "$WAIT_FOR_IFUP: F= ile not found"<br /> = exit 2<br /> fi<br /> = fi<br />}<br /><br /><br />start() {<br />  = ; echo "Starting IPv4 shorewall rules..."<br /> = wait_for_pppd<br /> [ -x /usr/sbin/mount_= modules ] && /usr/sbin/mount_modules<br /> &nbs= p; /sbin/shorewall $OPTIONS start $STARTOPTIONS<br /> &= nbsp; [ -x /usr/sbin/umount_modules ] && /usr/sbin/umount_modules<b= r />}<br /><br />stop() {<br /> echo "Stopping I= Pv4 shorewall rules..."<br /> /sbin/shorewall st= op<br />}<br /><br />refresh() {<br /> echo "Ref= reshing IPv4 shorewall rules..."<br /> /sbin/sho= rewall refresh $REFRESHOPTIONS<br />}<br /><br /><br />reload() {<br />&nbs= p; echo "Reloading IPv4 shorewall rules..."<br /> = ; /sbin/shorewall reload $RELOADOPTIONS<br />}<br /><b= r />restart() {<br /> echo "Restarting IPv4 shor= ewall rules..."<br /> [ -x /usr/sbin/mount_modul= es ] && /usr/sbin/mount_modules<br /> /s= bin/shorewall restart $RESTARTOPTIONS<br /> [ -x= /usr/sbin/umount_modules ] && /usr/sbin/umount_modules<br />}<br /= ><br />status() {<br /> /sbin/shorewall status<b= r />}<br /><br />case "$1" in<br /> 'start')<br />  = ; start<br /> = ;;<br /> 'stop')<br /> &nbs= p; stop<br /> ;;<br /> = ; 'refresh')<br /> &= nbsp; refresh<br /> ;;<br /> 'reloa= d')<br /> reload<br = /> ;;<br /> 'restart')<br /> = restart<br /> = ;;<br /> 'status')<br /> &n= bsp; status<br /> ;;= <br /> *)<br />  = ; echo "Usage: $0 start|stop|refresh|reload|restart|status"<br />&nb= sp; ;;<br />esac<br /><br />exit 0<br /><br /># All do= ne</p> <p>- Bob</p> <div> <p class=3D"v1MsoNormal">On 1/13/2026 11:36:39 AM, <a href=3D"mailto:rcorte= [email protected]" rel=3D"noreferrer">[email protected]</a> wrote:</p> </div> <blockquote style=3D"margin-top: 5.0pt; margin-bottom: 5.0pt;"> <p>Hi Robert,</p> <p>Do you mean shorewall show log or other?</p> <p><br /></p> <p>Thx</p> <p><br /></p> <p id=3D"v1reply-intro">El 2026-01-13 13:11, Robert K Coffman Jr. -Info Fro= m Data Corp. escribió:</p> <blockquote style=3D"border: none; border-left: solid #1010FF 1.5pt; paddin= g: 0cm 0cm 0cm 5.0pt; margin-left: 0cm; margin-right: 0cm;"> <div id=3D"v1replybody1"> <p>Ok - what do the logs say after a reboot? One potential issue that= might cause this is the status of any interfaces that are required but not= ready when shorewall starts.</p> <div> <p class=3D"v1MsoNormal">On 1/13/2026 9:52:47 AM, <a href=3D"mailto:rcortes= @edos.cl" rel=3D"noreferrer">[email protected]</a> wrote:</p> </div> <blockquote style=3D"border: none; border-left: solid #1010FF 1.5pt; paddin= g: 0cm 0cm 0cm 5.0pt; margin-left: 0cm; margin-right: 0cm;"> <p>Hi Robert,</p> <p><br /></p> <p>I'm using systemcl </p> <p><br /></p> <p>systemctl enable shorewall after install package.</p> <p><br /></p> <p>Thx.</p> <p><br /></p> <p id=3D"v1v1reply-intro">El 2026-01-13 10:30, Robert K Coffman Jr. -Info F= rom Data Corp. escribió:</p> <blockquote style=3D"border: none; border-left: solid #1010FF 1.5pt; paddin= g: 0cm 0cm 0cm 5.0pt; margin-left: 0cm; margin-right: 0cm;"> <div id=3D"v1v1replybody1"> <p>How are you starting Shorewall after a reboot?</p> <p><br /></p> <div> <p class=3D"v1MsoNormal">On 1/13/2026 5:59:25 AM, rcortes--- via Shorewall-= users wrote:</p> </div> <blockquote style=3D"border: none; border-left: solid #1010FF 1.5pt; paddin= g: 0cm 0cm 0cm 5.0pt; margin-left: 0cm; margin-right: 0cm;"> <p class=3D"v1MsoNormal">Hi Simon, <br /><br />i use shorewall from shorewa= ll site reference, in this case 5.1.12 from <a href=3D"https://shorewall.or= g/pub/shorewall/5.1/shorewall-5.1.12/" target=3D"_blank" rel=3D"noopener no= referrer">https://shorewall.org/pub/shorewall/5.1/shorewall-5.1.12/</a> <br= />and 5.2.8 from <a href=3D"https://www.invoca.ch/pub/packages/shorewall/R= PMS/ils-7/noarch/" target=3D"_blank" rel=3D"noopener noreferrer">https://ww= w.invoca.ch/pub/packages/shorewall/RPMS/ils-7/noarch/</a> <br /><br />5.1.1= 2 or 5.1.10 start but dont work, need apply clear/start to work. <br />5.2.= 8-12 start but dont work nat/dnat/proxyarp <br /><br />Thx <br /><br />El 2= 026-01-13 04:56, Simon Matter escribió:</p> <blockquote style=3D"border: none; border-left: solid #1010FF 1.5pt; paddin= g: 0cm 0cm 0cm 5.0pt; margin-left: 0cm; margin-right: 0cm;"> <p class=3D"v1MsoNormal" style=3D"margin-bottom: 12.0pt;">Hi,</p> <blockquote style=3D"border: none; border-left: solid #1010FF 1.5pt; paddin= g: 0cm 0cm 0cm 5.0pt; margin-left: 0cm; margin-right: 0cm;"> <p class=3D"v1MsoNormal">Hello everyone! <br /><br />Somebody know why or h= ow to fix shorewall for not need clear and start <br />after reboot? = i have EL7 and shorewall 5.1.12, previously working with <br />5.1.10 and t= ry with 5.2.8-12 but shorewall start but nat/dnat/proxyarp <br />dont work.= </p> </blockquote> <p class=3D"v1MsoNormal"><br />Seems that your shorewall start is not worki= ng properly. Are you using a <br />shorewall package from epel? If so you c= ould check the changelog to see <br />who has packaged it and ask directly?= <br /><br />Regards, <br />Simon</p> </blockquote> <p class=3D"v1MsoNormal"><br /><br />______________________________________= _________ <br />Shorewall-users mailing list <br /><a href=3D"mailto:Shorew= [email protected]" rel=3D"noreferrer">[email protected]= ourceforge.net</a> <br /><a href=3D"https://lists.sourceforge.net/lists/lis= tinfo/shorewall-users" target=3D"_blank" rel=3D"noopener noreferrer">https:= //lists.sourceforge.net/lists/listinfo/shorewall-users</a></p> </blockquote> <pre>-- </pre> <pre>Robert K Coffman Jr.</pre> <pre>Info From Data Corp.</pre> <pre>3307249000</pre> <pre><a href=3D"mailto:[email protected]" rel=3D"noreferrer">support= @infofromdata.com</a></pre> </div> <p class=3D"v1MsoNormal"> </p> <div> <p class=3D"v1MsoNormal"><span style=3D"font-family: 'Courier New';">______= _________________________________________<br />Shorewall-users mailing list= <br /><a href=3D"mailto:[email protected]" rel=3D"noref= errer">[email protected]</a><br /><a href=3D"https://li= sts.sourceforge.net/lists/listinfo/shorewall-users" target=3D"_blank" rel= =3D"noopener noreferrer">https://lists.sourceforge.net/lists/listinfo/shore= wall-users</a></span></p> </div> </blockquote> </blockquote> <pre>-- </pre> <pre>Robert K Coffman Jr.</pre> <pre>Info From Data Corp.</pre> <pre>3307249000</pre> <pre><a href=3D"mailto:[email protected]" rel=3D"noreferrer">support= @infofromdata.com</a></pre> </div> <p class=3D"v1MsoNormal"> </p> <div> <p class=3D"v1MsoNormal"><span style=3D"font-family: 'Courier New';">______= _________________________________________<br />Shorewall-users mailing list= <br /><a href=3D"mailto:[email protected]" rel=3D"noref= errer">[email protected]</a><br /><a href=3D"https://li= sts.sourceforge.net/lists/listinfo/shorewall-users" target=3D"_blank" rel= =3D"noopener noreferrer">https://lists.sourceforge.net/lists/listinfo/shore= wall-users</a></span></p> </div> </blockquote> </blockquote> <pre>-- </pre> <pre>Robert K Coffman Jr.</pre> <pre>Info From Data Corp.</pre> <pre>3307249000</pre> <pre><a href=3D"mailto:[email protected]" rel=3D"noreferrer">support= @infofromdata.com</a></pre> </div> </div> <br /> <div class=3D"pre" style=3D"margin: 0; padding: 0; font-family: monospace">= _______________________________________________<br />Shorewall-users mailin= g list<br /><a href=3D"mailto:[email protected]">Shorew= [email protected]</a><br /><a href=3D"https://lists.sourcefor= ge.net/lists/listinfo/shorewall-users" target=3D"_blank" rel=3D"noopener no= referrer">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a><= /div> </blockquote> </body></html> --=_b55595e89791338cfbd4e7c0bf310671-- --===============3050533344766807464== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============3050533344766807464== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline