arno firewall and 2.6.20 kernel?

I get the following error when running arno's firewall script using a 2.6.20 kernel:

00:08:25 root@gbnet:/usr/src/linux-2.6.20# /etc/rc.d/rc.firewall start
Arno's Iptables Firewall Script v1.8.8h
-------------------------------------------------------------------------------
Sanity checks passed...OK
Checking/probing Iptables modules:
NOTE: Module "ip_conntrack" not found. Assuming it is compiled in the kernel
NOTE: Module "iptable_nat" not found. Assuming it is compiled in the kernel
 Module check done...
Setting the kernel ring buffer to only log panic messages to the console
Configuring /proc/.... settings:
 Enabling anti-spoof with rp_filter
 Enabling SYN-flood protection via SYN-cookies
 Disabling the logging of martians
 Disabling the acception of ICMP-redirect messages
 WARNING: /proc/../ip_conntrack_max was NOT found. This may be a problem!
 Enabling protection against source routed packets
 Setting default conntrack timeouts
/etc/rc.d/rc.firewall: line 605: /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout: No such file or directory
/etc/rc.d/rc.firewall: line 606: /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout_stream: No such file or directory
 Enabling reduction of the DoS'ing ability
 Setting Default TTL=64
 Disabling ECN (Explicit Congestion Notification)
 Flushing route table
 /proc/ setup done...
Flushing rules in the filter table
Setting default (secure) policies
Using loglevel "debug" for syslogd

Setting up firewall rules:
-------------------------------------------------------------------------------
Accepting packets from the local loopback device
Enabling setting the maximum packet size via MSS
Enabling mangling TOS
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
Logging of stealth scans (nmap probes etc.) enabled
Logging of packets with bad TCP-flags enabled
Logging of INVALID TCP packets disabled
Logging of INVALID UDP packets disabled
Logging of INVALID ICMP packets disabled
iptables: Unknown error 4294967295
Logging of fragmented packets enabled
Logging of access from reserved addresses enabled
Setting up anti-spoof rules
Reading custom rules from /etc/arno-iptables-firewall/custom-rules
/etc/arno-iptables-firewall/custom-rules: line 3: [: too many arguments
Setting up INPUT policy for the external net (INET):
 Logging of explicitly blocked hosts enabled
 Logging of denied local output connections enabled
 Packets will NOT be checked for private source addresses
 Denying the whole world to send ICMP-requests(ping)
 Logging of dropped ICMP-request(ping) packets enabled
 Logging of dropped other ICMP packets enabled
 Logging of possible stealth scans enabled
 Logging of (other) connection attempts to PRIVILEGED TCP ports enabled
 Logging of (other) connection attempts to PRIVILEGED UDP ports enabled
 Logging of (other) connection attempts to UNPRIVILEGED TCP ports enabled
 Logging of (other) connection attempts to UNPRIVILEGED UDP ports enabled
 Logging of other IP protocols (non TCP/UDP/ICMP) connection attempts enabled
 Logging of ICMP flooding enabled
Setting up OUTPUT policy for the external net (INET):
 Allowing all (other) ports/protocols
Applying INET policy to external interface: eth0 (without an external subnet specified)
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
iptables: Unknown error 4294967295
Security is ENFORCED for external interface(s) in the FORWARD chain

Feb 08  0:08:31 All firewall rules applied.

It seems it can't find the ip_conntrack and iptable_nat kernel modules.

Is there something I need to enable to get these two kernel modules?

Here is the networking part of my 2.6.20 .config file:

#
# Networking
#
CONFIG_NET=y

#
# Networking options
#
# CONFIG_NETDEBUG is not set
CONFIG_PACKET=y
CONFIG_PACKET_MMAP=y
CONFIG_UNIX=y
CONFIG_XFRM=y
CONFIG_XFRM_USER=y
# CONFIG_XFRM_SUB_POLICY is not set
CONFIG_NET_KEY=m
CONFIG_INET=y
CONFIG_IP_MULTICAST=y
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_ASK_IP_FIB_HASH=y
# CONFIG_IP_FIB_TRIE is not set
CONFIG_IP_FIB_HASH=y
CONFIG_IP_MULTIPLE_TABLES=y
CONFIG_IP_ROUTE_MULTIPATH=y
# CONFIG_IP_ROUTE_MULTIPATH_CACHED is not set
CONFIG_IP_ROUTE_VERBOSE=y
# CONFIG_IP_PNP is not set
CONFIG_NET_IPIP=m
CONFIG_NET_IPGRE=m
CONFIG_NET_IPGRE_BROADCAST=y
CONFIG_IP_MROUTE=y
CONFIG_IP_PIMSM_V1=y
CONFIG_IP_PIMSM_V2=y
# CONFIG_ARPD is not set
CONFIG_SYN_COOKIES=y
CONFIG_INET_AH=m
CONFIG_INET_ESP=m
CONFIG_INET_IPCOMP=m
CONFIG_INET_XFRM_TUNNEL=m
CONFIG_INET_TUNNEL=m
CONFIG_INET_XFRM_MODE_TRANSPORT=y
CONFIG_INET_XFRM_MODE_TUNNEL=y
CONFIG_INET_XFRM_MODE_BEET=y
CONFIG_INET_DIAG=m
CONFIG_INET_TCP_DIAG=m
# CONFIG_TCP_CONG_ADVANCED is not set
CONFIG_TCP_CONG_CUBIC=y
CONFIG_DEFAULT_TCP_CONG="cubic"
# CONFIG_TCP_MD5SIG is not set

Regards,

Gregory Bowden

It has been awhile since I ran the Slack, but check in /etc/rc.modules, I think. I'm pretty sure you'll just need to uncomment those two modules.

It seems because I enabled this option:

< > Netfilter connection tracking support

It no longer created the ip_conntrack module and created a nf_conntrack module instead.

I'm recompiling the kernel to see if that fixes the problem.

Update:

I've just restared with my new kernel and everything is working fine. I accidently added some experimental kernel modules.

I've also finally got dazuko to compile for on-access anti virus scanning.

Regards,

Gregory Bowden

Originally Posted by gbowden It seems because I enabled this option: < > Netfilter connection tracking support It no longer created the ip_conntrack module and created a nf_conntrack module instead. I'm recompiling the kernel to see if that fixes the problem. Update: I've just restared with my new kernel and everything is working fine. I accidently added some experimental kernel modules. I've also finally got dazuko to compile for on-access anti virus scanning. Regards, Gregory Bowden

I also run Slack 11 and have just recompiled the kernel but am getting iptable errors now that I didn't get with 2.6.19.2. Would you post your entire .config or just indicate which experimental modules got included by mistake?

Have a look at this post

http://www.linuxquestions.org/questi...d.php?t=526097

looked at that post and tried a make oldconfig but never got any prompts about NAT. I get these errors when I do a make menuconfig:

.config:189:warning: trying to assign nonexistent symbol REGPARM
.config:326:warning: trying to assign nonexistent symbol IP_ROUTE_FWMARK
.config:471:warning: trying to assign nonexistent symbol IP_NF_MATCH_HASHLIMIT
.config:1362:warning: trying to assign nonexistent symbol FTAPE
.config:1363:warning: trying to assign nonexistent symbol ZFTAPE
.config:1364:warning: trying to assign nonexistent symbol ZFT_DFLT_BLK_SZ
.config:1369:warning: trying to assign nonexistent symbol ZFT_COMPRESSOR
.config:1370:warning: trying to assign nonexistent symbol FT_NR_BUFFERS
.config:1371:warning: trying to assign nonexistent symbol FT_PROC_FS
.config:1372:warning: trying to assign nonexistent symbol FT_NORMAL_DEBUG
.config:1373:warning: trying to assign nonexistent symbol FT_FULL_DEBUG
.config:1374:warning: trying to assign nonexistent symbol FT_NO_TRACE
.config:1375:warning: trying to assign nonexistent symbol FT_NO_TRACE_AT_ALL
.config:1380:warning: trying to assign nonexistent symbol FT_STD_FDC
.config:1381:warning: trying to assign nonexistent symbol FT_MACH2
.config:1382:warning: trying to assign nonexistent symbol FT_PROBE_FC10
.config:1383:warning: trying to assign nonexistent symbol FT_ALT_FDC
.config:1384:warning: trying to assign nonexistent symbol FT_FDC_THR
.config:1385:warning: trying to assign nonexistent symbol FT_FDC_MAX_RATE
.config:1386:warning: trying to assign nonexistent symbol FT_ALPHA_CLOCK
.config:1842:warning: trying to assign nonexistent symbol USB_HIDINPUT
.config:2264:warning: trying to assign nonexistent symbol UNWIND_INFO

I'm running a server with no X session and soundcard support on a 10 year old Pentium 1-how do I fix these errors in my .config?

Follow these instructions
make menuconfig
:: Networking
:: Networking Options
:: Network Packet Filtering (Netfilter)
:: Core Netfilter Config.
== Netfilter connection tracking suppot (Y/M)
:: IP Netfilter Config.
== IPv4 connection tracking support (Y/M)
== Full NAT (Y/M)
Save; exit && rebuilt.