# Can't start shorewall, problem with insmod iptables I think

## Birnenpfluecker

Hi, I am a noob to linux and espacially to iptables and shorewall so please give simple answers and tips. I want a firewall on a box which is connected direct to the web via a dsl-modem. I used the quickstart guide and sample config for one interface and use shorewall 1.4.6.  My problem is following 

When I try to start shorewall I get the following output:

 *Quote:*   

> Loading /usr/share/shorewall/functions...
> 
> Processing /etc/shorewall/params ...
> 
> Processing /etc/shorewall/shorewall.conf...
> ...

 

If I read this correct I have problem with iptables in the kernel. What must be enabled in the kernel or is it another problem??

----------

## bosse

I have a similar problem. Yes, you need iptables support in the kernel. It´s under networking options and you must enable "network packet filtering"  (or something similar) to see the iptables option.

In my case this was not enough (se my question "Iptables" in this forum). I got two answers but I´m still without firewall. 

I hope we will get an answer under this thread...

----------

## ronmon

Yeah, go into Netfilter Configuration and make everything that is not labeled experimental as a module so that Shorewall can load what it needs. The only exceptions are NAT of local connections, ipchains and ipfwadm; which you should not need.

----------

## Birnenpfluecker

Thanks for the answers. 

I'm compiling Open Office at the moment, but when it's done, I'll try your suggstions.

----------

## Birnenpfluecker

Did all the things you mentioned, but I get the same error as above  :Sad: 

Any other ideas?

----------

## Birnenpfluecker

looked around some more and tried to include most points in the kernel, but when I try to compile it with 

 *Quote:*   

>  make dep && make clean bzImage modules modules_install
> 
> 

 

I get  *Quote:*   

>  ipt_realm.c: In function `match':
> 
> ipt_realm.c:29: structure has no member named `tclassid'
> 
> make[2]: *** [ipt_realm.o] Error 1
> ...

 

at the end of compiling and then he aborts without a bzImage.

 :Crying or Very sad: 

----------

## ronmon

Maybe you could run your make commands one at a time. That would make it clearer as to where the build is failing. Also, try 'make clean' before 'make dep' so you are starting fresh.

----------

## Birnenpfluecker

Did that now. He turns the error whlie make modules.

So I think he doesn't compile netfilter right. That would explain why shorewall doesn't find any netfilter/iptables abillitys. Any suggestions what to do?   :Confused: 

----------

## Birnenpfluecker

kernel is compiled right    :Smile: 

Had to remove the  ip tables realm support. After that he compiled without failures. But cannot start shorewall   :Sad: 

----------

## bosse

I guess you are where I am right now. Kernel compiles but still no working firewall. What happens if you "insmod ip_tables"?

----------

## bosse

I guess you are where I am right now. Kernel compiled but still no working firewall. What happens if you "insmod ip_tables"?

----------

## davecs

Hi I am trying to use Shorewall as it is easy for a standalone computer (or at least it was in Mandrake):

Anyway here is the message I got when I did

shorewall start

----------

Starting Shorewall...

Loading Modules...

Initializing...

Shorewall has detected the following iptables/netfilter capabilities:

   NAT: Not available

   Packet Mangling: Available

   Multi-port Match: Not available

   Connection Tracking Match: Not available

Determining Zones...

   Zones: net

Validating interfaces file...

Validating hosts file...

Validating Policy file...

Determining Hosts in Zones...

   Net Zone: eth0:0.0.0.0/0

Processing /etc/shorewall/init ...

Deleting user chains...

iptables: No chain/target/match by that name

Processing /etc/shorewall/stop ...

Processing /etc/shorewall/stopped ...

Terminated

----------

After this had run, the internet was no more, and the only way I could get the connection back was to reboot.

At least I had used a terminal so I could cut and paste the output before I reconnected!

Any ideas?

----------

## yahewitt

Make sure your kernel is compiled as described in

http://www.shorewall.net/kernel.htm

and don't forget to re-emerge ip-tables if you change the kernel - ip-tables has to be 

compiled with /usr/src/linux pointing to the current kernel tree I believe.

I had similar problems, but eventually got things to run!

----------

## davecs

 *yahewitt wrote:*   

> Make sure your kernel is compiled as described in
> 
> http://www.shorewall.net/kernel.htm
> 
> and don't forget to re-emerge ip-tables if you change the kernel - ip-tables has to be 
> ...

 

Do you know I couldn't find that page on the shorewall website. Must have been having a bad day.

Anyway, I installed kmyfirewall, it gave the sort of error report which made it easy to know EXACTLY what modules it wanted, I added them (fortunately they were all modules rather than in-kernel) so I just had to "make modules" and "make modules_install" and a reboot later, plus a re-install of the nvidia drivers (pests they are always have to reload them) and another reboot and we are up and running.

Just gonna do another reboot and make sure everything is working. Bye for now!

----------

## Birnenpfluecker

@ bosse

When I do an insmod ip_tables I get:

 *Quote:*   

> Using /lib/modules/2.4.20-gentoo-r5/kernel/net/ipv4/netfilter/ip_tables.o
> 
> /lib/modules/2.4.20-gentoo-r5/kernel/net/ipv4/netfilter/ip_tables.o: unresolved symbol nf_register_sockopt_R01c083d2
> 
> /lib/modules/2.4.20-gentoo-r5/kernel/net/ipv4/netfilter/ip_tables.o: unresolved symbol nf_unregister_sockopt_R942dfce3
> ...

 

----------

## bosse

You get the same errormessage as I, sorry I can´t help you.  Is there anyone else out there who has a clue about this?

----------

## bosse

I am still working on this, so I cant give you any real answer to your problems, but I got a lot of help from: http://iptables-tutorial.frozentux.net/iptables-tutorial.html

There is a chapter about kernel setup which tells a lot about necessary modules. 

Good luck!

----------

## Birnenpfluecker

thx, I'll try when I have time.

----------

## drtebi

I just went through the same problems (although I only installed iptables, not shorewall).

After searching the forum a bit, I noticed a link to this FAQ:

https://forums.gentoo.org/viewtopic.php?t=3913

I pretty much followed the exact instructions and got it to work.

I skipped step 2 though, since I did not think I needed new kernel sources. However, follow the other steps exactly as mentioned there, then emerge iptables again, and finally restart.

If you did the extra entry in the grub menu, you will be able to choose your new configured kernel at boot-up.

Once my new kernel booted, I simply added one rule:

```
iptables -I INPUT -s 38.115.4.0/24 -j DROP
```

(I am happily revealing this person's ip, who is running a script every 30 seconds since 2 weeks, trying to abuse my server as an open mail relay which I of course don't have)

and then I simply did

```
/etc/init.d/iptables start
```

It all worked, and my logs are no more filled with rubbish  :Wink: 

----------

