LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
Reload this Page Generic Firewall script
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices


Reply
Page 5 of 6 « First 34 5 6
  Search this Thread
Old 11-19-2021, 04:12 AM   #61
_peter
Member
 
Registered: Sep 2014
Location: paris
Distribution: slackware
Posts: 314

Rep: Reputation: Disabled

agreed, feeding the Slackware Documentation Project at https://docs.slackware.com is a big plus.
Last edited by _peter; 11-19-2021 at 04:13 AM. Reason: missing "a"
 
1 members found this post helpful.
Old 11-19-2021, 11:05 AM   #62
PROBLEMCHYLD
Senior Member
 
Registered: Apr 2015
Posts: 1,201

Rep: Reputation: Disabled
Here's my firewall rules, seems to do the job.......

Code:
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -N INBOUND
iptables -A INPUT -j LOG
iptables -A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -p tcp -m tcp --sport 1:65535 --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -A INPUT -s 127.0.0.1/32 -i wlan0 -j DROP
iptables -A INPUT -s 192.168.122.1/32 -i virbr0 -j DROP
iptables -A INPUT -p icmp -m icmp --icmp-type any -j DROP
iptables -A INPUT -p tcp -m tcp --dport 43 -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags ALL URG,PSH,FIN -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags ALL URG,ACK,PSH,RST,SYN,FIN -j DROP
iptables -A INPUT -p all -f -j DROP
iptables -A INPUT -p udp -m udp -m multiport --dports 513,33434:33524 -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
iptables -A INPUT -d 224.0.0.251/32 -p udp -m udp --sport 5353 --dport 5353 -j ACCEPT
iptables -A INPUT -d 224.0.0.1/32 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 19301 -m state --state NEW -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 19301 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p gre -j ACCEPT
iptables -A INPUT -m set --match-set lan src -j ACCEPT
iptables -A INPUT -m set --match-set intruders src -j DROP
iptables -A INPUT -p tcp -m tcp -j DROP
iptables -A INPUT -p udp -m udp -j DROP
iptables -A INPUT -j DROP
iptables -A INBOUND -j DROP
iptables -N OUTBOUND
iptables -A OUTPUT -j LOG
iptables -A OUTPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p gre -j ACCEPT
iptables -A OUTPUT -p igmp -j ACCEPT
iptables -A OUTPUT -p ah -m ah -j ACCEPT
iptables -A OUTPUT -p udp -m udp --sport 67 --dport 68 -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 123 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 631 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 853 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 873 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 1723 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 3690 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 9418 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 19300 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 19301 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -m udp --sport 19301 -j ACCEPT
iptables -A OUTPUT -d 185.193.27.46/32 -p tcp -m tcp -m multiport --dports 20,21,1024:65535 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp -m multiport --dports 25,110,143,465,587,993,995 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp -m multiport --dports 80,443 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -m udp -m multiport --dports 137,138 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp -m multiport --dports 139,445 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -m udp -m multiport --dports 500,1701,4500 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp -m multiport --dports 6667,6668,6697,7000 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -m set --match-set ports src -j ACCEPT
iptables -A OUTPUT -d 127.0.0.1/32 -j DROP
iptables -A OUTPUT -d 192.168.122.1/32 -j DROP
iptables -A OUTPUT -p tcp -m tcp -j DROP
iptables -A OUTPUT -p udp -m udp -j DROP
iptables -A OUTPUT -j DROP
iptables -A OUTBOUND -j DROP
iptables -N FORWARDING
iptables -A FORWARD -j LOG
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -o lo -j ACCEPT
iptables -A FORWARDING -j DROP
iptables -N PREROUTE
iptables -t nat -A PREROUTING -j LOG
iptables -N POSTROUTE
iptables -t nat -A POSTROUTING -j LOG
 
1 members found this post helpful.
Old 11-19-2021, 11:10 AM   #63
SCerovec
Senior Member
 
Registered: Oct 2006
Location: Cp6uja
Distribution: Slackware on x86 and arm
Posts: 2,478
Blog Entries: 2

Rep: Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982
Someone mentioned Shorewall and i used that, aron's, a custom set and what you get from webmin.

It was on an small "enterprise" mail server.

My conclusion (project ended long time ago):

1. Slackware 15.0 will really benefit from PAM so future mail servers can have virtual users instead of real ones.
2. Shorewall was nice, webmin was a solution, but alas, being popular known and ill maintained was a huge security hole/risk, arno's was a good start but had to be tweaked to fit.
3. No generic firewall will make you Linux box more secure - and that is a fact.
4. There is no "generic Slackware" box/laptop out there and that is good (mono culture weakens security)

BUT:

A. The instant you configure and have sshd, samba, NFS or any other services up and running on your PC/box/laptop and have to travel and be a guess on a foreign network (be it GSM, WiFi, unknown LAN or whatever) You better have something that's filtering traffic!

So:
rc.firewall hook is excellent move in that direction
and:
I. I see no harm for an generic rc.firewall script shipped with Slackware alongside that
II. A script people could begin with and build their own custom tailored firewall
III. Post it here for IDK a contest, thread or just sheer idea exchange and brain storming (like we do ricing on the "This is my Slackware Desktop" thread)
IV. One day we have a well tested set of scripts to choose from or edit by commenting out as many other things in /etc already are (rc.firewall.sample ?)
V. Meanwhile people can make that firewall doc page there too?


We do it the Slackware way?
Last edited by SCerovec; 11-19-2021 at 11:15 AM. Reason: typos, tons of typos :-[
 
3 members found this post helpful.
Old 11-19-2021, 11:12 AM   #64
SCerovec
Senior Member
 
Registered: Oct 2006
Location: Cp6uja
Distribution: Slackware on x86 and arm
Posts: 2,478
Blog Entries: 2

Rep: Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982
Quote:
Originally Posted by PROBLEMCHYLD View Post
Here's my firewall rules, seems to do the job.......

Code:
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -N INBOUND
iptables -A INPUT -j LOG
iptables -A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -p tcp -m tcp --sport 1:65535 --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -A INPUT -s 127.0.0.1/32 -i wlan0 -j DROP
iptables -A INPUT -s 192.168.122.1/32 -i virbr0 -j DROP
iptables -A INPUT -p icmp -m icmp --icmp-type any -j DROP
iptables -A INPUT -p tcp -m tcp --dport 43 -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags ALL URG,PSH,FIN -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags ALL URG,ACK,PSH,RST,SYN,FIN -j DROP
iptables -A INPUT -p all -f -j DROP
iptables -A INPUT -p udp -m udp -m multiport --dports 513,33434:33524 -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
iptables -A INPUT -d 224.0.0.251/32 -p udp -m udp --sport 5353 --dport 5353 -j ACCEPT
iptables -A INPUT -d 224.0.0.1/32 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 19301 -m state --state NEW -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 19301 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p gre -j ACCEPT
iptables -A INPUT -m set --match-set lan src -j ACCEPT
iptables -A INPUT -m set --match-set intruders src -j DROP
iptables -A INPUT -p tcp -m tcp -j DROP
iptables -A INPUT -p udp -m udp -j DROP
iptables -A INPUT -j DROP
iptables -A INBOUND -j DROP
iptables -N OUTBOUND
iptables -A OUTPUT -j LOG
iptables -A OUTPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p gre -j ACCEPT
iptables -A OUTPUT -p igmp -j ACCEPT
iptables -A OUTPUT -p ah -m ah -j ACCEPT
iptables -A OUTPUT -p udp -m udp --sport 67 --dport 68 -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 123 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 631 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 853 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 873 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 1723 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 3690 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 9418 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 19300 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 19301 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -m udp --sport 19301 -j ACCEPT
iptables -A OUTPUT -d 185.193.27.46/32 -p tcp -m tcp -m multiport --dports 20,21,1024:65535 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp -m multiport --dports 25,110,143,465,587,993,995 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp -m multiport --dports 80,443 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -m udp -m multiport --dports 137,138 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp -m multiport --dports 139,445 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp -m udp -m multiport --dports 500,1701,4500 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp -m multiport --dports 6667,6668,6697,7000 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -m set --match-set ports src -j ACCEPT
iptables -A OUTPUT -d 127.0.0.1/32 -j DROP
iptables -A OUTPUT -d 192.168.122.1/32 -j DROP
iptables -A OUTPUT -p tcp -m tcp -j DROP
iptables -A OUTPUT -p udp -m udp -j DROP
iptables -A OUTPUT -j DROP
iptables -A OUTBOUND -j DROP
iptables -N FORWARDING
iptables -A FORWARD -j LOG
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -o lo -j ACCEPT
iptables -A FORWARDING -j DROP
iptables -N PREROUTE
iptables -t nat -A PREROUTING -j LOG
iptables -N POSTROUTE
iptables -t nat -A POSTROUTING -j LOG
Now if the networks (sources, targets and netmasks) where put in meaningful variables,
Same for commands with full paths (hardening)
It's a good start...
 
Old 11-19-2021, 03:09 PM   #65
PROBLEMCHYLD
Senior Member
 
Registered: Apr 2015
Posts: 1,201

Rep: Reputation: Disabled
Quote:
Originally Posted by SCerovec View Post
Now if the networks (sources, targets and netmasks) where put in meaningful variables,
Same for commands with full paths (hardening)
It's a good start...
You mean like this?

iptables -A OUTPUT -p tcp -m tcp -m multiport --dports 80,443 -m state --state NEW -j ACCEPT -m comment --comment "HTTP,HTTPS"


https://github.com/puux/iptables
Attached Thumbnails
Click image for larger version Name: Screenshot_2021-11-19_15-11-57.png Views: 63 Size: 136.2 KB ID: 37733  
Last edited by PROBLEMCHYLD; 11-19-2021 at 03:16 PM.
 
1 members found this post helpful.
Old 11-20-2021, 05:57 AM   #66
gauchao
Member
 
Registered: Dec 2009
Location: Veneto
Distribution: Slackware64
Posts: 366

Rep: Reputation: 143Reputation: 143
I have been using Alien Bob's Easy Firewall Generator since Slack 13.0 and it has always worked nicely. After generating a basic firewall you can always tune it according to your needs.

http://www.slackware.com/~alien/efg/
 
2 members found this post helpful.
Old 01-02-2022, 09:12 PM   #67
RadicalDreamer
Senior Member
 
Registered: Jul 2016
Location: USA
Distribution: Slackware64-Current
Posts: 1,816

Rep: Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982
"Firewall testers needed

This newest release of liveslak brings something that was recently discussed on linuxquestions.org. What about adding a basic firewall configuration to the freshly installed Slackware system? A new Slackware Linux computer may have several ports open already and some people are paranoid about any prying from the outside."

"But in particular I want people to test the dialog-based configurator and give me feedback. You’ll notice that the configurator allows you to go back and forth in the various dialog windows. I also want to know what you think of the questions and the level of simplicity. Also look at the installed rc.firewall script. Does it do what you need it to do?"
https://alien.slackbook.org/blog/fre...asic-firewall/
 
2 members found this post helpful.
Old 01-02-2022, 09:27 PM   #68
hitest
Guru
 
Registered: Mar 2004
Location: Canada
Distribution: Void, Slackware, Debian, OpenBSD
Posts: 7,345

Rep: Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746
Quote:
Originally Posted by SCerovec View Post
Ever used a laptop in public place? ever used it to connect to an open hotspot?

Ever joined an install fest or a lan party?

Internet caffee?
Yep. I use a VPN on a sketchy network along with a firewall. I like using PF on my BSD installations. I like UFW on Linux. The good people at SBo have an install script for UFW.
 
2 members found this post helpful.
Old 01-03-2022, 02:56 PM   #69
SCerovec
Senior Member
 
Registered: Oct 2006
Location: Cp6uja
Distribution: Slackware on x86 and arm
Posts: 2,478
Blog Entries: 2

Rep: Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982Reputation: 982
Thumbs up
@alienBOB:
This is exactly what I had in mind:

The very basic firewall generator for the use case of an most basic work station in an presumed possibly hostile environment (an open public network).

I downloaded the two scripts from the https://git.liveslak.org/liveslak/ directory: tree/setup2hd:

SeTfirewall.tpl
rc.firewall.tpl

and renamed them myfwconf and rc.firewall respectively.
For the test run i had them both reside on ~/bin/ and i noticed the myfwconf fails to run as normal user, Once i became root it ran fine and completed with few selected ports and three (3) interfaces configured.

The scripts generated seemed fine, however i would gladly see one minor thing changed:

The line 240 (or so) where the interfaces are listed into the DEV_LIST var to be used in the dialog could use a space between the adjacent interface names:

Code:
240c240
<     DEV_LIST=$(for INDEV in ${!NETDEVARR[@]} ; do if [ "${NETDEVARR[$INDEV]}" = "on" ]; then echo -n $INDEV ; fi ; done)
---
>     DEV_LIST=$(for INDEV in ${!NETDEVARR[@]} ; do if [ "${NETDEVARR[$INDEV]}" = "on" ]; then echo -n $INDEV" " ; fi ; done)
Not that it changes much, but it cures my OCD
 
1 members found this post helpful.
Old 01-04-2022, 05:41 AM   #70
mlangdn
Senior Member
 
Registered: Mar 2005
Location: Kentucky
Distribution: Slackware64-current
Posts: 1,845

Original Poster
Rep: Reputation: 452Reputation: 452Reputation: 452Reputation: 452Reputation: 452
@SCerovec:

I tried what you did and get this:

Code:
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `mangle': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `mangle': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `mangle': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `mangle': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
Could not open socket to kernel: Address family not supported by protocol
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
Could not open socket to kernel: Address family not supported by protocol
Could not open socket to kernel: Address family not supported by protocol
Could not open socket to kernel: Address family not supported by protocol
Could not open socket to kernel: Address family not supported by protocol
Could not open socket to kernel: Address family not supported by protocol
Could not open socket to kernel: Address family not supported by protocol
Could not open socket to kernel: Address family not supported by protocol
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
Could not open socket to kernel: Address family not supported by protocol
Could not open socket to kernel: Address family not supported by protocol
Could not open socket to kernel: Address family not supported by protocol
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
Could not open socket to kernel: Address family not supported by protocol
Could not open socket to kernel: Address family not supported by protocol
Could not open socket to kernel: Address family not supported by protocol
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
Could not open socket to kernel: Address family not supported by protocol
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
Could not open socket to kernel: Address family not supported by protocol
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
Could not open socket to kernel: Address family not supported by protocol
Could not open socket to kernel: Address family not supported by protocol
Could not open socket to kernel: Address family not supported by protocol
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.7 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.
Could not open socket to kernel: Address family not supported by protocol
root@darkstar:/home/michael/bin#
I am running current, and have no idea what this means. I had an append in lilo to disable ipv6, but I removed that line, rebooted, and tried again. I am not running any other firewall.
 
Old 01-04-2022, 06:22 AM   #71
teoberi
Member
 
Registered: Jan 2018
Location: Romania
Distribution: Slackware64-current (servers)/Windows 11/Ubuntu (workstations)
Posts: 614

Rep: Reputation: 357Reputation: 357Reputation: 357Reputation: 357
Code:
lsmod | grep ip6table
 
Old 01-04-2022, 06:32 AM   #72
mlangdn
Senior Member
 
Registered: Mar 2005
Location: Kentucky
Distribution: Slackware64-current
Posts: 1,845

Original Poster
Rep: Reputation: 452Reputation: 452Reputation: 452Reputation: 452Reputation: 452
@teoberi - that returned nothing. There is a module running called ip6_tables.
 
Old 01-04-2022, 06:36 AM   #73
teoberi
Member
 
Registered: Jan 2018
Location: Romania
Distribution: Slackware64-current (servers)/Windows 11/Ubuntu (workstations)
Posts: 614

Rep: Reputation: 357Reputation: 357Reputation: 357Reputation: 357
Code:
lsmod | grep ip6table_filter
 
Old 01-04-2022, 06:43 AM   #74
Petri Kaukasoina
Senior Member
 
Registered: Mar 2007
Posts: 1,854

Rep: Reputation: 1521Reputation: 1521Reputation: 1521Reputation: 1521Reputation: 1521Reputation: 1521Reputation: 1521Reputation: 1521Reputation: 1521Reputation: 1521Reputation: 1521
Quote:
Originally Posted by mlangdn View Post
I had an append in lilo to disable ipv6, but I removed that line, rebooted, and tried again.
But did not run lilo?
 
1 members found this post helpful.
Old 01-04-2022, 06:43 AM   #75
teoberi
Member
 
Registered: Jan 2018
Location: Romania
Distribution: Slackware64-current (servers)/Windows 11/Ubuntu (workstations)
Posts: 614

Rep: Reputation: 357Reputation: 357Reputation: 357Reputation: 357
Quote:
Originally Posted by Petri Kaukasoina View Post
But did not run lilo?
Good question
 
  


Reply
Page 5 of 6 « First 34 5 6



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] setting up initrd / generic kernel in Grub2...can't load generic Ubunoob001 Slackware 12 03-20-2015 07:32 AM
what are initrd.img-2.6.28-11-generic and vmlinuz-2.6.28-11-generic? karuna-bdc Linux - Newbie 11 07-17-2009 05:00 AM
Update from 2.6.27-13-generic to 2.6.27-14-generic fails bobreeves Linux - Kernel 1 03-19-2009 09:02 AM
GART TLB error generic level generic Clydesdale Linux - Software 1 08-13-2007 06:47 PM
GART TLB error generic level generic Clydesdale Linux - Hardware 0 08-13-2007 06:18 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware

All times are GMT -5. The time now is 03:29 PM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration