Re: Shorewall need clear to work after reboot
rcortes--- via Shorewall-users <[email protected]> Tue, 13 Jan 2026 16:28:12 -0300
| Newsgroups | gmane.comp.security.shorewall |
|---|---|
| Message-ID | <[email protected]> |
--===============8810113275023860883==
Content-Type: multipart/alternative;
boundary="=_e10a92eda79d040e83587db64cb537e1"
--=_e10a92eda79d040e83587db64cb537e1
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=UTF-8;
format=flowed
Robert,
/var/log/shorewall-init.log exist, tonight reboot system without log and
post before.
shorewall for EL7 o CentOS7 or similar use systemctl, maybe shorewall
start before other service. Somebody have experience with this?
Thx
El 2026-01-13 14:57, Robert K Coffman Jr. -Info From Data Corp.
escribió:
> Logging is too deep for me to go into here - on my system, there is a
> shorewall-init log in /var/log. I suspect your system has this in
> logcontrol.
>
> Here is the contents of the init.d job that starts shorewall on my
> firewalls. For some changes to my configuration, I have to use this
> script before shorewall start, or else the change doesn't work. I only
> bring it up because perhaps the difference between
> "/etc/init.d/shorewall start" and "shorewall start" could be used to
> fix your problem. Strictly speculation however.
>
> #!/bin/sh
>
> RCDLINKS="2,S19 3,S19 4,S19 5,S19 0,K91 6,K91"
>
> OPTIONS=""
>
> WAIT_FOR_IFUP=/usr/share/shorewall/wait4ifup
>
> # Use /etc/default shorewall to specify $OPTIONS and STARTOPTIONS to
> # run at startup, however this this might prevent shorewall from
> # starting. use at your own risk
> if [ -f "/etc/default/shorewall" ] ; then
> . /etc/default/shorewall
> fi
>
> # wait for an unconfigured interface
> wait_for_pppd () {
> if [ "$wait_interface" != "" ]
> then
> if [ -f $WAIT_FOR_IFUP ]
> then
> for i in $wait_interface
> do
> $WAIT_FOR_IFUP $i 60
> done
> else
> echo "$WAIT_FOR_IFUP: File not found"
> exit 2
> fi
> fi
> }
>
> start() {
> echo "Starting IPv4 shorewall rules..."
> wait_for_pppd
> [ -x /usr/sbin/mount_modules ] && /usr/sbin/mount_modules
> /sbin/shorewall $OPTIONS start $STARTOPTIONS
> [ -x /usr/sbin/umount_modules ] && /usr/sbin/umount_modules
> }
>
> stop() {
> echo "Stopping IPv4 shorewall rules..."
> /sbin/shorewall stop
> }
>
> refresh() {
> echo "Refreshing IPv4 shorewall rules..."
> /sbin/shorewall refresh $REFRESHOPTIONS
> }
>
> reload() {
> echo "Reloading IPv4 shorewall rules..."
> /sbin/shorewall reload $RELOADOPTIONS
> }
>
> restart() {
> echo "Restarting IPv4 shorewall rules..."
> [ -x /usr/sbin/mount_modules ] && /usr/sbin/mount_modules
> /sbin/shorewall restart $RESTARTOPTIONS
> [ -x /usr/sbin/umount_modules ] && /usr/sbin/umount_modules
> }
>
> status() {
> /sbin/shorewall status
> }
>
> case "$1" in
> 'start')
> start
> ;;
> 'stop')
> stop
> ;;
> 'refresh')
> refresh
> ;;
> 'reload')
> reload
> ;;
> 'restart')
> restart
> ;;
> 'status')
> status
> ;;
> *)
> echo "Usage: $0 start|stop|refresh|reload|restart|status"
> ;;
> esac
>
> exit 0
>
> # All done
>
> - Bob
>
> On 1/13/2026 11:36:39 AM, [email protected] wrote:
>
> Hi Robert,
>
> Do you mean shorewall show log or other?
>
> Thx
>
> El 2026-01-13 13:11, Robert K Coffman Jr. -Info From Data Corp.
> escribió:
>
> Ok - what do the logs say after a reboot? One potential issue that
> might cause this is the status of any interfaces that are required but
> not ready when shorewall starts.
>
> On 1/13/2026 9:52:47 AM, [email protected] wrote:
>
> Hi Robert,
>
> I'm using systemcl
>
> systemctl enable shorewall after install package.
>
> Thx.
>
> El 2026-01-13 10:30, Robert K Coffman Jr. -Info From Data Corp.
> escribió:
>
> How are you starting Shorewall after a reboot?
>
> On 1/13/2026 5:59:25 AM, rcortes--- via Shorewall-users wrote: Hi
> Simon,
>
> i use shorewall from shorewall site reference, in this case 5.1.12 from
> https://shorewall.org/pub/shorewall/5.1/shorewall-5.1.12/
> and 5.2.8 from
> https://www.invoca.ch/pub/packages/shorewall/RPMS/ils-7/noarch/
>
> 5.1.12 or 5.1.10 start but dont work, need apply clear/start to work.
> 5.2.8-12 start but dont work nat/dnat/proxyarp
>
> Thx
>
> El 2026-01-13 04:56, Simon Matter escribió:
> Hi,
>
> Hello everyone!
>
> Somebody know why or how to fix shorewall for not need clear and start
> after reboot? i have EL7 and shorewall 5.1.12, previously working with
> 5.1.10 and try with 5.2.8-12 but shorewall start but nat/dnat/proxyarp
> dont work.
> Seems that your shorewall start is not working properly. Are you using
> a
> shorewall package from epel? If so you could check the changelog to see
> who has packaged it and ask directly?
>
> Regards,
> Simon
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
--
Robert K Coffman Jr.
Info From Data Corp.
3307249000
[email protected]
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
--
Robert K Coffman Jr.
Info From Data Corp.
3307249000
[email protected]
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
--
Robert K Coffman Jr.
Info From Data Corp.
3307249000
[email protected]
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
--=_e10a92eda79d040e83587db64cb537e1
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=UTF-8
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=
=3DUTF-8" /></head><body style=3D'font-size: 10pt; font-family: Verdana,Gen=
eva,sans-serif'>
<p>Robert,</p>
<p><br /></p>
<p>/var/log/shorewall-init.log exist, tonight reboot system without log and=
post before.</p>
<p><br /></p>
<p>shorewall for EL7 o CentOS7 or similar use systemctl, maybe shorewall st=
art before other service. Somebody have experience with this?</p>
<p><br /></p>
<p>Thx</p>
<div id=3D"signature"></div>
<p><br /></p>
<p id=3D"reply-intro">El 2026-01-13 14:57, Robert K Coffman Jr. -Info From =
Data Corp. escribió:</p>
<blockquote type=3D"cite" style=3D"padding: 0 0.4em; border-left: #1010ff 2=
px solid; margin: 0">
<div id=3D"replybody1">
<p>Logging is too deep for me to go into here - on my system, there is a sh=
orewall-init log in /var/log. I suspect your system has this in logco=
ntrol.</p>
<p>Here is the contents of the init.d job that starts shorewall on my firew=
alls. For some changes to my configuration, I have to use this script=
before shorewall start, or else the change doesn't work. I only brin=
g it up because perhaps the difference between "/etc/init.d/shorewall start=
" and "shorewall start" could be used to fix your problem. Strictly s=
peculation however.</p>
<p>#!/bin/sh<br /><br />RCDLINKS=3D"2,S19 3,S19 4,S19 5,S19 0,K91 6,K91"<br=
/><br />OPTIONS=3D""<br /><br />WAIT_FOR_IFUP=3D/usr/share/shorewall/wait4=
ifup<br /><br /># Use /etc/default shorewall to specify $OPTIONS and STARTO=
PTIONS to<br /># run at startup, however this this might prevent shorewall =
from<br /># starting. use at your own risk<br />if [ -f "/etc/default/shore=
wall" ] ; then<br /> . /etc/default/shorewall<br />fi<br /><br=
/># wait for an unconfigured interface<br />wait_for_pppd () {<br /> =
if [ "$wait_interface" !=3D "" ]<br /> &=
nbsp; then<br /> if [ -f $WA=
IT_FOR_IFUP ]<br /> then<br /> =
; for i in $wait_interface=
<br /> do<br /> =
; &nb=
sp; $WAIT_FOR_IFUP $i 60<br /> &nb=
sp; done<br /> else<br />&nb=
sp; echo "$WAIT_FOR_IFUP: F=
ile not found"<br /> =
exit 2<br /> fi<br /> =
fi<br />}<br /><br /><br />start() {<br />  =
; echo "Starting IPv4 shorewall rules..."<br /> =
wait_for_pppd<br /> [ -x /usr/sbin/mount_=
modules ] && /usr/sbin/mount_modules<br /> &nbs=
p; /sbin/shorewall $OPTIONS start $STARTOPTIONS<br /> &=
nbsp; [ -x /usr/sbin/umount_modules ] && /usr/sbin/umount_modules<b=
r />}<br /><br />stop() {<br /> echo "Stopping I=
Pv4 shorewall rules..."<br /> /sbin/shorewall st=
op<br />}<br /><br />refresh() {<br /> echo "Ref=
reshing IPv4 shorewall rules..."<br /> /sbin/sho=
rewall refresh $REFRESHOPTIONS<br />}<br /><br /><br />reload() {<br />&nbs=
p; echo "Reloading IPv4 shorewall rules..."<br /> =
; /sbin/shorewall reload $RELOADOPTIONS<br />}<br /><b=
r />restart() {<br /> echo "Restarting IPv4 shor=
ewall rules..."<br /> [ -x /usr/sbin/mount_modul=
es ] && /usr/sbin/mount_modules<br /> /s=
bin/shorewall restart $RESTARTOPTIONS<br /> [ -x=
/usr/sbin/umount_modules ] && /usr/sbin/umount_modules<br />}<br /=
><br />status() {<br /> /sbin/shorewall status<b=
r />}<br /><br />case "$1" in<br /> 'start')<br />  =
; start<br /> =
;;<br /> 'stop')<br /> &nbs=
p; stop<br /> ;;<br /> =
; 'refresh')<br /> &=
nbsp; refresh<br /> ;;<br /> 'reloa=
d')<br /> reload<br =
/> ;;<br /> 'restart')<br /> =
restart<br /> =
;;<br /> 'status')<br /> &n=
bsp; status<br /> ;;=
<br /> *)<br />  =
; echo "Usage: $0 start|stop|refresh|reload|restart|status"<br />&nb=
sp; ;;<br />esac<br /><br />exit 0<br /><br /># All do=
ne</p>
<p>- Bob</p>
<div class=3D"v1moz-cite-prefix">On 1/13/2026 11:36:39 AM, <a class=3D"v1mo=
z-txt-link-abbreviated" href=3D"mailto:[email protected]" rel=3D"noreferrer">=
[email protected]</a> wrote:</div>
<blockquote type=3D"cite" style=3D"padding: 0 0.4em; border-left: #1010ff 2=
px solid; margin: 0">
<p>Hi Robert,</p>
<p>Do you mean shorewall show log or other?</p>
<p><br /></p>
<p>Thx</p>
<p><br /></p>
<p id=3D"v1reply-intro">El 2026-01-13 13:11, Robert K Coffman Jr. -Info Fro=
m Data Corp. escribió:</p>
<blockquote style=3D"padding: 0 0.4em; border-left: #1010ff 2px solid; marg=
in: 0;">
<div id=3D"v1replybody1">
<p>Ok - what do the logs say after a reboot? One potential issue that=
might cause this is the status of any interfaces that are required but not=
ready when shorewall starts.</p>
<div class=3D"v1v1moz-cite-prefix">On 1/13/2026 9:52:47 AM, <a class=3D"v1v=
1moz-txt-link-abbreviated v1moz-txt-link-freetext" href=3D"mailto:rcortes@e=
dos.cl" rel=3D"noreferrer">[email protected]</a> wrote:</div>
<blockquote style=3D"padding: 0 0.4em; border-left: #1010ff 2px solid; marg=
in: 0;">
<p>Hi Robert,</p>
<p><br /></p>
<p>I'm using systemcl </p>
<p><br /></p>
<p>systemctl enable shorewall after install package.</p>
<p><br /></p>
<p>Thx.</p>
<p><br /></p>
<p id=3D"v1v1reply-intro">El 2026-01-13 10:30, Robert K Coffman Jr. -Info F=
rom Data Corp. escribió:</p>
<blockquote style=3D"padding: 0 0.4em; border-left: #1010ff 2px solid; marg=
in: 0;">
<div id=3D"v1v1replybody1">
<p>How are you starting Shorewall after a reboot?</p>
<p><br /></p>
<div class=3D"v1v1v1moz-cite-prefix">On 1/13/2026 5:59:25 AM, rcortes--- vi=
a Shorewall-users wrote:</div>
<blockquote style=3D"padding: 0 0.4em; border-left: #1010ff 2px solid; marg=
in: 0;">Hi Simon, <br /><br />i use shorewall from shorewall site reference=
, in this case 5.1.12 from <a class=3D"v1v1v1moz-txt-link-freetext v1v1moz-=
txt-link-freetext v1moz-txt-link-freetext" href=3D"https://shorewall.org/pu=
b/shorewall/5.1/shorewall-5.1.12/" target=3D"_blank" rel=3D"noopener norefe=
rrer">https://shorewall.org/pub/shorewall/5.1/shorewall-5.1.12/</a> <br />a=
nd 5.2.8 from <a class=3D"v1v1v1moz-txt-link-freetext v1v1moz-txt-link-free=
text v1moz-txt-link-freetext" href=3D"https://www.invoca.ch/pub/packages/sh=
orewall/RPMS/ils-7/noarch/" target=3D"_blank" rel=3D"noopener noreferrer">h=
ttps://www.invoca.ch/pub/packages/shorewall/RPMS/ils-7/noarch/</a> <br /><b=
r />5.1.12 or 5.1.10 start but dont work, need apply clear/start to work. <=
br />5.2.8-12 start but dont work nat/dnat/proxyarp <br /><br />Thx <br /><=
br />El 2026-01-13 04:56, Simon Matter escribió: <br />
<blockquote style=3D"padding: 0 0.4em; border-left: #1010ff 2px solid; marg=
in: 0;">Hi, <br /><br />
<blockquote style=3D"padding: 0 0.4em; border-left: #1010ff 2px solid; marg=
in: 0;">Hello everyone! <br /><br />Somebody know why or how to fix shorewa=
ll for not need clear and start <br />after reboot? i have EL7 and sh=
orewall 5.1.12, previously working with <br />5.1.10 and try with 5.2.8-12 =
but shorewall start but nat/dnat/proxyarp <br />dont work.</blockquote>
<br />Seems that your shorewall start is not working properly. Are you usin=
g a <br />shorewall package from epel? If so you could check the changelog =
to see <br />who has packaged it and ask directly? <br /><br />Regards, <br=
/>Simon</blockquote>
<br /><br />_______________________________________________ <br />Shorewall=
-users mailing list <br /><a class=3D"v1v1v1moz-txt-link-abbreviated v1v1mo=
z-txt-link-freetext v1moz-txt-link-freetext" href=3D"mailto:Shorewall-users=
@lists.sourceforge.net" rel=3D"noreferrer">[email protected]=
e.net</a> <br /><a class=3D"v1v1v1moz-txt-link-freetext v1v1moz-txt-link-fr=
eetext v1moz-txt-link-freetext" href=3D"https://lists.sourceforge.net/lists=
/listinfo/shorewall-users" target=3D"_blank" rel=3D"noopener noreferrer">ht=
tps://lists.sourceforge.net/lists/listinfo/shorewall-users</a></blockquote>
<pre class=3D"v1v1v1moz-signature">--=20
Robert K Coffman Jr.
Info From Data Corp.
3307249000
<a class=3D"v1v1v1moz-txt-link-abbreviated v1v1moz-txt-link-freetext v1moz-=
txt-link-freetext" href=3D"mailto:[email protected]" rel=3D"noreferr=
er">[email protected]</a></pre>
</div>
<br />
<div class=3D"v1v1pre" style=3D"margin: 0; padding: 0; font-family: monospa=
ce;">_______________________________________________<br />Shorewall-users m=
ailing list<br /><a class=3D"v1v1moz-txt-link-freetext v1moz-txt-link-freet=
ext" href=3D"mailto:[email protected]" rel=3D"noreferre=
r">[email protected]</a><br /><a class=3D"v1v1moz-txt-l=
ink-freetext v1moz-txt-link-freetext" href=3D"https://lists.sourceforge.net=
/lists/listinfo/shorewall-users" target=3D"_blank" rel=3D"noopener noreferr=
er">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a></div>
</blockquote>
</blockquote>
<pre class=3D"v1v1moz-signature">--=20
Robert K Coffman Jr.
Info From Data Corp.
3307249000
<a class=3D"v1v1moz-txt-link-abbreviated v1moz-txt-link-freetext" href=3D"m=
ailto:[email protected]" rel=3D"noreferrer">[email protected]=
</a></pre>
</div>
<br />
<div class=3D"v1pre" style=3D"margin: 0; padding: 0; font-family: monospace=
;">_______________________________________________<br />Shorewall-users mai=
ling list<br /><a class=3D"v1moz-txt-link-freetext" href=3D"mailto:Shorewal=
[email protected]" rel=3D"noreferrer">[email protected]=
rceforge.net</a><br /><a class=3D"v1moz-txt-link-freetext" href=3D"https://=
lists.sourceforge.net/lists/listinfo/shorewall-users" target=3D"_blank" rel=
=3D"noopener noreferrer">https://lists.sourceforge.net/lists/listinfo/shore=
wall-users</a></div>
</blockquote>
</blockquote>
<pre class=3D"v1moz-signature">--=20
Robert K Coffman Jr.
Info From Data Corp.
3307249000
<a class=3D"v1moz-txt-link-abbreviated" href=3D"mailto:support@infofromdata=
=2Ecom" rel=3D"noreferrer">[email protected]</a></pre>
</div>
<br />
<div class=3D"pre" style=3D"margin: 0; padding: 0; font-family: monospace">=
_______________________________________________<br />Shorewall-users mailin=
g list<br /><a href=3D"mailto:[email protected]">Shorew=
[email protected]</a><br /><a href=3D"https://lists.sourcefor=
ge.net/lists/listinfo/shorewall-users" target=3D"_blank" rel=3D"noopener no=
referrer">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a><=
/div>
</blockquote>
</body></html>
--=_e10a92eda79d040e83587db64cb537e1--
--===============8810113275023860883==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============8810113275023860883==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline