LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 02-07-2007, 05:19 PM   #1
gbowden
Member
 
Registered: Dec 2003
Location: Spain
Distribution: Slackware 14.1
Posts: 146

Rep: Reputation: 27
Question arno firewall and 2.6.20 kernel?


I get the following error when running arno's firewall script using a 2.6.20 kernel:

Code:
00:08:25 root@gbnet:/usr/src/linux-2.6.20# /etc/rc.d/rc.firewall start
Arno's Iptables Firewall Script v1.8.8h
-------------------------------------------------------------------------------
Sanity checks passed...OK
Checking/probing Iptables modules:
NOTE: Module "ip_conntrack" not found. Assuming it is compiled in the kernel
NOTE: Module "iptable_nat" not found. Assuming it is compiled in the kernel
 Module check done...
Setting the kernel ring buffer to only log panic messages to the console
Configuring /proc/.... settings:
 Enabling anti-spoof with rp_filter
 Enabling SYN-flood protection via SYN-cookies
 Disabling the logging of martians
 Disabling the acception of ICMP-redirect messages
 WARNING: /proc/../ip_conntrack_max was NOT found. This may be a problem!
 Enabling protection against source routed packets
 Setting default conntrack timeouts
/etc/rc.d/rc.firewall: line 605: /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout: No such file or directory
/etc/rc.d/rc.firewall: line 606: /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout_stream: No such file or directory
 Enabling reduction of the DoS'ing ability
 Setting Default TTL=64
 Disabling ECN (Explicit Congestion Notification)
 Flushing route table
 /proc/ setup done...
Flushing rules in the filter table
Setting default (secure) policies
Using loglevel "debug" for syslogd

Setting up firewall rules:
-------------------------------------------------------------------------------
Accepting packets from the local loopback device
Enabling setting the maximum packet size via MSS
Enabling mangling TOS
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
Logging of stealth scans (nmap probes etc.) enabled
Logging of packets with bad TCP-flags enabled
Logging of INVALID TCP packets disabled
Logging of INVALID UDP packets disabled
Logging of INVALID ICMP packets disabled
iptables: Unknown error 4294967295
Logging of fragmented packets enabled
Logging of access from reserved addresses enabled
Setting up anti-spoof rules
Reading custom rules from /etc/arno-iptables-firewall/custom-rules
/etc/arno-iptables-firewall/custom-rules: line 3: [: too many arguments
Setting up INPUT policy for the external net (INET):
 Logging of explicitly blocked hosts enabled
 Logging of denied local output connections enabled
 Packets will NOT be checked for private source addresses
 Denying the whole world to send ICMP-requests(ping)
 Logging of dropped ICMP-request(ping) packets enabled
 Logging of dropped other ICMP packets enabled
 Logging of possible stealth scans enabled
 Logging of (other) connection attempts to PRIVILEGED TCP ports enabled
 Logging of (other) connection attempts to PRIVILEGED UDP ports enabled
 Logging of (other) connection attempts to UNPRIVILEGED TCP ports enabled
 Logging of (other) connection attempts to UNPRIVILEGED UDP ports enabled
 Logging of other IP protocols (non TCP/UDP/ICMP) connection attempts enabled
 Logging of ICMP flooding enabled
Setting up OUTPUT policy for the external net (INET):
 Allowing all (other) ports/protocols
Applying INET policy to external interface: eth0 (without an external subnet specified)
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
Security is ENFORCED for external interface(s) in the FORWARD chain

Feb 08  0:08:31 All firewall rules applied.
It seems it can't find the ip_conntrack and iptable_nat kernel modules.

Is there something I need to enable to get these two kernel modules?

Here is the networking part of my 2.6.20 .config file:

Code:
#
# Networking
#
CONFIG_NET=y

#
# Networking options
#
# CONFIG_NETDEBUG is not set
CONFIG_PACKET=y
CONFIG_PACKET_MMAP=y
CONFIG_UNIX=y
CONFIG_XFRM=y
CONFIG_XFRM_USER=y
# CONFIG_XFRM_SUB_POLICY is not set
CONFIG_NET_KEY=m
CONFIG_INET=y
CONFIG_IP_MULTICAST=y
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_ASK_IP_FIB_HASH=y
# CONFIG_IP_FIB_TRIE is not set
CONFIG_IP_FIB_HASH=y
CONFIG_IP_MULTIPLE_TABLES=y
CONFIG_IP_ROUTE_MULTIPATH=y
# CONFIG_IP_ROUTE_MULTIPATH_CACHED is not set
CONFIG_IP_ROUTE_VERBOSE=y
# CONFIG_IP_PNP is not set
CONFIG_NET_IPIP=m
CONFIG_NET_IPGRE=m
CONFIG_NET_IPGRE_BROADCAST=y
CONFIG_IP_MROUTE=y
CONFIG_IP_PIMSM_V1=y
CONFIG_IP_PIMSM_V2=y
# CONFIG_ARPD is not set
CONFIG_SYN_COOKIES=y
CONFIG_INET_AH=m
CONFIG_INET_ESP=m
CONFIG_INET_IPCOMP=m
CONFIG_INET_XFRM_TUNNEL=m
CONFIG_INET_TUNNEL=m
CONFIG_INET_XFRM_MODE_TRANSPORT=y
CONFIG_INET_XFRM_MODE_TUNNEL=y
CONFIG_INET_XFRM_MODE_BEET=y
CONFIG_INET_DIAG=m
CONFIG_INET_TCP_DIAG=m
# CONFIG_TCP_CONG_ADVANCED is not set
CONFIG_TCP_CONG_CUBIC=y
CONFIG_DEFAULT_TCP_CONG="cubic"
# CONFIG_TCP_MD5SIG is not set
Regards,

Gregory Bowden
 
Old 02-07-2007, 05:23 PM   #2
cgjones
Member
 
Registered: Nov 2005
Location: Central New York
Distribution: Ubuntu
Posts: 405

Rep: Reputation: 30
It has been awhile since I ran the Slack, but check in /etc/rc.modules, I think. I'm pretty sure you'll just need to uncomment those two modules.
 
Old 02-07-2007, 05:33 PM   #3
gbowden
Member
 
Registered: Dec 2003
Location: Spain
Distribution: Slackware 14.1
Posts: 146

Original Poster
Rep: Reputation: 27
It seems because I enabled this option:

< > Netfilter connection tracking support

It no longer created the ip_conntrack module and created a nf_conntrack module instead.

I'm recompiling the kernel to see if that fixes the problem.

Update:

I've just restared with my new kernel and everything is working fine. I accidently added some experimental kernel modules.

I've also finally got dazuko to compile for on-access anti virus scanning.

Regards,

Gregory Bowden

Last edited by gbowden; 02-07-2007 at 06:42 PM.
 
Old 02-09-2007, 09:10 PM   #4
linuxhippy
Senior Member
 
Registered: Sep 2004
Location: Philadelphia, PA
Distribution: Xubuntu, Mythbuntu, Lubuntu, Picuntu
Posts: 1,189

Rep: Reputation: 47
Quote:
Originally Posted by gbowden
It seems because I enabled this option:

< > Netfilter connection tracking support

It no longer created the ip_conntrack module and created a nf_conntrack module instead.

I'm recompiling the kernel to see if that fixes the problem.

Update:

I've just restared with my new kernel and everything is working fine. I accidently added some experimental kernel modules.

I've also finally got dazuko to compile for on-access anti virus scanning.

Regards,

Gregory Bowden

I also run Slack 11 and have just recompiled the kernel but am getting iptable errors now that I didn't get with 2.6.19.2. Would you post your entire .config or just indicate which experimental modules got included by mistake?
 
Old 02-10-2007, 05:30 PM   #5
arno
Member
 
Registered: Jul 2004
Location: Netherlands
Distribution: fedora core 8, suse 10.3, ubuntu 7.10, kamikaze 7.09
Posts: 515

Rep: Reputation: 30
Have a look at this post

http://www.linuxquestions.org/questi...d.php?t=526097
 
Old 02-11-2007, 02:27 PM   #6
linuxhippy
Senior Member
 
Registered: Sep 2004
Location: Philadelphia, PA
Distribution: Xubuntu, Mythbuntu, Lubuntu, Picuntu
Posts: 1,189

Rep: Reputation: 47
looked at that post and tried a make oldconfig but never got any prompts about NAT. I get these errors when I do a make menuconfig:

.config:189:warning: trying to assign nonexistent symbol REGPARM
.config:326:warning: trying to assign nonexistent symbol IP_ROUTE_FWMARK
.config:471:warning: trying to assign nonexistent symbol IP_NF_MATCH_HASHLIMIT
.config:1362:warning: trying to assign nonexistent symbol FTAPE
.config:1363:warning: trying to assign nonexistent symbol ZFTAPE
.config:1364:warning: trying to assign nonexistent symbol ZFT_DFLT_BLK_SZ
.config:1369:warning: trying to assign nonexistent symbol ZFT_COMPRESSOR
.config:1370:warning: trying to assign nonexistent symbol FT_NR_BUFFERS
.config:1371:warning: trying to assign nonexistent symbol FT_PROC_FS
.config:1372:warning: trying to assign nonexistent symbol FT_NORMAL_DEBUG
.config:1373:warning: trying to assign nonexistent symbol FT_FULL_DEBUG
.config:1374:warning: trying to assign nonexistent symbol FT_NO_TRACE
.config:1375:warning: trying to assign nonexistent symbol FT_NO_TRACE_AT_ALL
.config:1380:warning: trying to assign nonexistent symbol FT_STD_FDC
.config:1381:warning: trying to assign nonexistent symbol FT_MACH2
.config:1382:warning: trying to assign nonexistent symbol FT_PROBE_FC10
.config:1383:warning: trying to assign nonexistent symbol FT_ALT_FDC
.config:1384:warning: trying to assign nonexistent symbol FT_FDC_THR
.config:1385:warning: trying to assign nonexistent symbol FT_FDC_MAX_RATE
.config:1386:warning: trying to assign nonexistent symbol FT_ALPHA_CLOCK
.config:1842:warning: trying to assign nonexistent symbol USB_HIDINPUT
.config:2264:warning: trying to assign nonexistent symbol UNWIND_INFO

I'm running a server with no X session and soundcard support on a 10 year old Pentium 1-how do I fix these errors in my .config?
 
Old 02-11-2007, 02:46 PM   #7
arno
Member
 
Registered: Jul 2004
Location: Netherlands
Distribution: fedora core 8, suse 10.3, ubuntu 7.10, kamikaze 7.09
Posts: 515

Rep: Reputation: 30
Follow these instructions
make menuconfig
:: Networking
:: Networking Options
:: Network Packet Filtering (Netfilter)
:: Core Netfilter Config.
== Netfilter connection tracking suppot (Y/M)
:: IP Netfilter Config.
== IPv4 connection tracking support (Y/M)
== Full NAT (Y/M)
Save; exit && rebuilt.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Kernel 2.6.x with APF firewall andy18 Linux - General 0 03-16-2005 01:19 PM
Kernel Firewall Support Aeiri Linux - Software 5 03-07-2004 09:13 AM
What firewall to use for 2.6.1 kernel? svarreby Slackware 4 02-09-2004 04:41 AM
Shorewall vs. Arno perry Linux - Security 1 12-24-2003 10:18 AM
arno iptables-firewall tangle Linux - Security 1 02-07-2003 03:09 AM


All times are GMT -5. The time now is 11:43 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration