# Shorewall does not start

## larand54

I have two machines, configured as dmz-firewall. One is backup for the other.

I have used the some configuration files for both. 

The old works but the new fails at startup telling that shorewall can not figure out how to route eth1.

The old was setup for 7 months ago but the backup is set up to day with kernel 2.6.17.6.

I realized that it was not possible to use yhe old config so I may have made an mistake there.

If someone could point out what to look at with such an error I would be happy.

----------

## glurps

i am experiencing such a problem too. do you get an error like this when you try to bring up the interface?:

```
j1 init.d # /etc/init.d/net.eth1 start

 * Starting eth1

 *   Bringing up eth1

 *     192.168.3.1                                                        [ ok ]

 *     netmask

 *     No loaded modules provide "netmask" (netmask_start)

 *     255.255.255.0                                                      [ ok ]

 *     broadcast

 *     No loaded modules provide "broadcast" (broadcast_start)

 *     192.168.3.255 
```

----------

## larand54

No, not like that,

```
/etc/init.d/shorewall start

 * Starting firewall ...

   ERROR: Unable to determine the routes through interface "eth1"

/etc/init.d/shorewall: line 14:  9844 Terminated              /sbin/shorewall -f start >/dev/null   
```

That's all I get.

```
 lsmod

Module                  Size  Used by

ipt_REJECT              3488  0

ipt_LOG                 4928  0

xt_limit                1920  0

xt_tcpudp               2592  2

xt_state                1632  2

xt_pkttype              1472  0

iptable_raw             1440  0

xt_CLASSIFY             1472  0

ipt_owner               1536  0

ipt_recent              8364  0

ipt_iprange             1376  0

xt_physdev              1936  0

xt_multiport            2656  0

xt_conntrack            1952  0

iptable_mangle          1984  0

ip_nat_irc              1824  0

ip_nat_tftp             1312  0

ip_nat_ftp              2432  0

iptable_nat             4804  0

ip_nat                 12236  4 ip_nat_irc,ip_nat_tftp,ip_nat_ftp,iptable_nat

ip_conntrack_irc        4752  1 ip_nat_irc

ip_conntrack_tftp       3032  1 ip_nat_tftp

ip_conntrack_ftp        5392  1 ip_nat_ftp

iptable_filter          2112  1

ip_tables               9704  4 iptable_raw,iptable_mangle,iptable_nat,iptable_filter

x_tables                9188  15 ipt_REJECT,ipt_LOG,xt_limit,xt_tcpudp,xt_state,xt_pkttype,xt_CLASSIFY,ipt_owner,ipt_recent,ipt_iprange,xt_physdev,xt_multiport,xt_conntrack,iptable_nat,ip_tables

```

That's all modules

Heres from interfaces:

```
#ZONE    INTERFACE      BROADCAST       OPTIONS                 GATEWAY

net     eth1            detect          dhcp

loc     eth0            172.16.68.255

dmz     eth2            192.168.0.255

#

#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

```

But I think my problem is that I didn't had eth1 connected and as it was dependent on dhcp it did not get any ip-address and that might blow the whole thing off.

I tried to connect eth1 to my lan instead of the ADSL and got an address and then started shorewall. It started but with a couple of warning messages about that the default route for eth1 is ignored.

Is that ok? I think I need to test the machine for real, connect it to internet, but the I need to stop my running fw and cannot do this now.

----------

## glurps

have a look at http://www.shorewall.net/ErrorMessages.html. i had the same error as you do. most likely eth1 isnt up yet when you start shorewall. make sure its up using ifconfig. 

this is my thead https://forums.gentoo.org/viewtopic-t-498367-highlight-.html. i made a stupid syntax error. just asign a ip as i did (well not as i did first ^^)

it doesnt have anything to do with shorewall. you simply have to bring up eth1 first.

----------

## larand54

Thanks, the explanations of error-messages is very helpful. I think I have everything under control now though, but we will se when I exchange the machines  :Wink: 

----------

