# Shorewall won't start (no explanation so far)

## Tii

I get this error: 

iptables v1.2.9: Couldn't load target 'drop':/lib/iptables/libipt_drop.so: cannot open shared object file: No such file or directory

As far as I can see there indeed isn't such a file. I just emerged shorewall (I'm using kernel 2.6.3-gentoo-r1) and it has worked just fine in the past. Is there perhaps more info I could post?

edit: edited the subjectLast edited by Tii on Sat Feb 28, 2004 6:58 pm; edited 2 times in total

----------

## steveb

how does you /etc/shorewall/modules looks like? my has the following content:

```
##############################################################################

# Shorewall 1.4 /etc/shorewall/modules

#

# This file loads the modules needed by the firewall.

#

# THE ORDER OF THE COMMANDS BELOW IS IMPORTANT!!!!!! You MUST load in

# dependency order. i.e., if M2 depends on M1 then you must load M1 before

# you load M2.

#

    loadmodule ip_tables

    loadmodule iptable_filter

    loadmodule ip_conntrack

    loadmodule ip_conntrack_ftp

    loadmodule ip_conntrack_tftp

    loadmodule ip_conntrack_irc

    loadmodule iptable_nat

    loadmodule ip_nat_ftp

    loadmodule ip_nat_tftp

    loadmodule ip_nat_irc
```

cheers

SteveB

----------

## Tii

It just the same. I compiled just about everything iptables related to the kernel as modules so the problem shoulden't be there.

----------

## steveb

 *Derryth wrote:*   

> It just the same. I compiled just about everything iptables related to the kernel as modules so the problem shoulden't be there.

 

hmmm.... this is an very dangerous statement! i would not bet that with the kernel everything is okay.

could you rebuild your kernel to be 100% sure that this is not an kernel issue? go to the kernel directory and do:

```
mv .config ../my-kernel-config

make mrproper

mv ../my-kernel-config ./.config

make && make modules_install
```

and then let me know if you still have the same problem.

cheers

SteveB

----------

## Tii

Sorry, it's a bad habit of mine rushing into conclusions. But I recompiled my kernel and it didn't help so it would seem that the kernel is fine.

----------

## steveb

 *Derryth wrote:*   

> Sorry, it's a bad habit of mine rushing into conclusions. But I recompiled my kernel and it didn't help so it would seem that the kernel is fine.

 did you used the make mrproper command?

another thing is to re-emerge iptables without using ccache and/or distcc. did you try that? and what about shorewall? try to re-emerge it as well.

cheers

SteveB

----------

## Tii

I used the mrproper just as you said. Took quite a while to compile. What's ccache? I don't use distcc (if it is that compile on several computers thingie). I'll re-emerge all three things that were emerged again though I think I did it once already.

edit: Recompiled everything again but it didn't help. Noticed that iptables doesn't install a file called that for some reason.Last edited by Tii on Sat Feb 28, 2004 5:43 pm; edited 1 time in total

----------

## steveb

 *Derryth wrote:*   

> I used the mrproper just as you said. Took quite a while to compile. What's ccache? I don't use distcc (if it is that compile on several computers thingie). I'll re-emerge all three things that were emerged again though I think I did it once already.

 okay.... looks like not an problem of kernel and not an problem of the packages.

can you check if the /usr/src/linux and /usr/src/linux-beta symlinks are pointing to the right direcotry?

and can you post some more info? maybe from the log?

cheers

SteveB

----------

## Tii

/usr/src/linux is pointing to my current kernel, I don't seem to have linux-beta symlink. What log should I post info from?

----------

## steveb

since gentoo is not using the 2.6.x series of the kernel for production, they do an symlink for the 2.6.x kernels. the symlink is called linux-beta.

manny ebuilds use that to check for 2.6.x kernels (some of the better ebuilds don't do that. they check the kernel version with uname or something like that).

can you create this symlink and then re-emerge shorewall and the iptables packages?

cheers

SteveB

----------

## Tii

I did the symlink but this didn't do the trick either (I have installed shorewall on three other 2.6 based kernel before without the symlink, so I would have been suprised if it had worked). And I just have to say that I'm really thankful for you helping me on this. This just seems to be a really weird problem.

----------

## steveb

okay... stop shorewall and any other application using the ip tables. then unload all the iptables modules:

```
for foo in $(ls /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter/*.ko) ; do bar=$(basename ${foo} | sed "s/\.ko//") ; rmmod  ${bar} ; done
```

check with lsmod if realy all of them are unloaded.

after that try to modprobe all of them and look wich one has an problem:

```
for foo in $(ls /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter/*.ko) ; do bar=$(basename ${foo} | sed "s/\.ko//") ; echo "trying ${bar}" ; modprobe ${bar} ; done
```

cheers

SteveB

----------

## steveb

 *Derryth wrote:*   

> And I just have to say that I'm really thankful for you helping me on this. This just seems to be a really weird problem.

 this is the purpose of this forum  :Wink: 

cheers

SteveB

----------

## Tii

I don't think I have anything else using iptables. How do  use that statement you wrote to unload the modues (it's the noob facor kicking in again)?

----------

## Tii

I seem to be getting some errors and all the modules dont unload.

ERROR: Module arp_tables does not exist in /proc/modules

ERROR: Module arpt_mangle does not exist in /proc/modules

ERROR: Module arptable_filter does not exist in /proc/modules

ERROR: Module ip_conntrack is in use by ip_nat_irc,ip_nat_tftp,ip_nat_ftp,ip_conntrack_irc,ip_conntrack_tftp,ip_conntrack_ftp,ipt_conntrack,iptable_nat,ipt_state

ERROR: Module ip_conntrack_amanda does not exist in /proc/modules

ERROR: Module ip_conntrack_ftp is in use by ip_nat_ftp

ERROR: Module ip_conntrack_irc is in use by ip_nat_irc

ERROR: Module ip_nat_amanda does not exist in /proc/modules

ERROR: Module ip_queue does not exist in /proc/modules

ERROR: Module ip_tables is in use by ipt_REJECT,ipt_LOG,ipt_multiport,ipt_conntrack,iptable_mangle,iptable_nat,ipt_state,iptable_filter

ERROR: Module ipt_CLASSIFY does not exist in /proc/modules

ERROR: Module ipt_DSCP does not exist in /proc/modules

ERROR: Module ipt_ECN does not exist in /proc/modules

ERROR: Module ipt_MARK does not exist in /proc/modules

ERROR: Module ipt_MASQUERADE does not exist in /proc/modules

ERROR: Module ipt_NETMAP does not exist in /proc/modules

ERROR: Module ipt_REDIRECT does not exist in /proc/modules

ERROR: Module ipt_SAME does not exist in /proc/modules

ERROR: Module ipt_TCPMSS does not exist in /proc/modules

ERROR: Module ipt_TOS does not exist in /proc/modules

ERROR: Module ipt_ULOG does not exist in /proc/modules

ERROR: Module ipt_ah does not exist in /proc/modules

ERROR: Module ipt_dscp does not exist in /proc/modules

ERROR: Module ipt_ecn does not exist in /proc/modules

ERROR: Module ipt_esp does not exist in /proc/modules

ERROR: Module ipt_helper does not exist in /proc/modules

ERROR: Module ipt_iprange does not exist in /proc/modules

ERROR: Module ipt_length does not exist in /proc/modules

ERROR: Module ipt_limit does not exist in /proc/modules

ERROR: Module ipt_mac does not exist in /proc/modules

ERROR: Module ipt_mark does not exist in /proc/modules

ERROR: Module ipt_owner does not exist in /proc/modules

ERROR: Module ipt_pkttype does not exist in /proc/modules

ERROR: Module ipt_recent does not exist in /proc/modules

ERROR: Module ipt_state is in use

ERROR: Module ipt_tcpmss does not exist in /proc/modules

ERROR: Module ipt_tos does not exist in /proc/modules

ERROR: Module ipt_ttl does not exist in /proc/modules

ERROR: Module iptable_filter is in use

Before I have these modules loaded:

Module                  Size  Used by

ipt_REJECT              5376  0

ipt_LOG                 5056  0

ip_nat_irc              3376  0

ip_nat_tftp             2736  0

ip_nat_ftp              4080  0

ip_conntrack_irc       70324  1 ip_nat_irc

ip_conntrack_tftp       2836  0

ip_conntrack_ftp       71092  1 ip_nat_ftp

ipt_multiport           1664  0

ipt_conntrack           1920  0

iptable_mangle          2112  0

iptable_nat            20652  3 ip_nat_irc,ip_nat_tftp,ip_nat_ftp

ipt_state               1472  2

iptable_filter          2176  1

ip_conntrack           26992  9 ip_nat_irc,ip_nat_tftp,ip_nat_ftp,ip_conntrack_irc,ip_conntrack_tftp,ip_conntrack_ftp,ipt_conntrack,iptable_nat,ipt_state

ip_tables              16256  8 ipt_REJECT,ipt_LOG,ipt_multiport,ipt_conntrack,iptable_mangle,iptable_nat,ipt_state,iptable_filter

fglrx                 202116  9

agpgart                26728  0

After I try that I only have:

Module                  Size  Used by

ip_conntrack_irc       70324  0

ip_conntrack_ftp       71092  0

ipt_state               1472  2

iptable_filter          2176  1

ip_conntrack           26992  3 ip_conntrack_irc,ip_conntrack_ftp,ipt_state

ip_tables              16256  2 ipt_state,iptable_filter

fglrx                 202116  9

agpgart                26728  0

Is there something loading that shouldn't be or is something missing? And how do I find out what's using them. I was able to modprobe -r a few but I'm left with:

Module                  Size  Used by

ipt_state               1472  2

iptable_filter          2176  1

ip_conntrack           26992  1 ipt_state

ip_tables              16256  2 ipt_state,iptable_filter

fglrx                 202116  9

agpgart                26728  0

----------

## steveb

run the command serval times, until all the modules are unloaded.

cheers

SteveB

btw: i am off now for serval hours. see you later.

----------

## Tii

Ok, I restarted and this way I certainly won't have any iptables related modules loaded (I checked).  I tired that and got helluva lot errors and no modules weren't loaded:

ERROR: Module arp_tables does not exist in /proc/modules

ERROR: Module arpt_mangle does not exist in /proc/modules

ERROR: Module arptable_filter does not exist in /proc/modules

ERROR: Module ip_conntrack does not exist in /proc/modules

ERROR: Module ip_conntrack_amanda does not exist in /proc/modules

ERROR: Module ip_conntrack_ftp does not exist in /proc/modules

ERROR: Module ip_conntrack_irc does not exist in /proc/modules

ERROR: Module ip_conntrack_tftp does not exist in /proc/modules

ERROR: Module ip_nat_amanda does not exist in /proc/modules

ERROR: Module ip_nat_ftp does not exist in /proc/modules

ERROR: Module ip_conntrack_irc does not exist in /proc/modules

ERROR: Module ip_conntrack_tftp does not exist in /proc/modules

ERROR: Module ip_nat_amanda does not exist in /proc/modules

ERROR: Module ip_nat_ftp does not exist in /proc/modules

ERROR: Module ip_nat_irc does not exist in /proc/modules

ERROR: Module ip_nat_tftp does not exist in /proc/modules

ERROR: Module ip_queue does not exist in /proc/modules

ERROR: Module ip_tables does not exist in /proc/modules

ERROR: Module ipt_CLASSIFY does not exist in /proc/modules

ERROR: Module ipt_DSCP does not exist in /proc/modules

ERROR: Module ipt_ECN does not exist in /proc/modules

ERROR: Module ipt_LOG does not exist in /proc/modules

ERROR: Module ipt_MARK does not exist in /proc/modules

ERROR: Module ipt_MASQUERADE does not exist in /proc/modules

ERROR: Module ipt_NETMAP does not exist in /proc/modules

ERROR: Module ipt_REDIRECT does not exist in /proc/modules

ERROR: Module ipt_REJECT does not exist in /proc/modules

ERROR: Module ipt_SAME does not exist in /proc/modules

ERROR: Module ipt_TCPMSS does not exist in /proc/modules

ERROR: Module ipt_TOS does not exist in /proc/modules

ERROR: Module ipt_ULOG does not exist in /proc/modules

ERROR: Module ipt_ah does not exist in /proc/modules

ERROR: Module ipt_conntrack does not exist in /proc/modules

ERROR: Module ipt_dscp does not exist in /proc/modules

ERROR: Module ipt_ecn does not exist in /proc/modules

ERROR: Module ipt_esp does not exist in /proc/modules

ERROR: Module ipt_helper does not exist in /proc/modules

ERROR: Module ipt_iprange does not exist in /proc/modules

ERROR: Module ipt_length does not exist in /proc/modules

ERROR: Module ipt_limit does not exist in /proc/modules

ERROR: Module ipt_mac does not exist in /proc/modules

ERROR: Module ipt_mark does not exist in /proc/modules

ERROR: Module ipt_multiport does not exist in /proc/modules

ERROR: Module ipt_owner does not exist in /proc/modules

ERROR: Module ipt_pkttype does not exist in /proc/modules

ERROR: Module ipt_recent does not exist in /proc/modules

ERROR: Module ipt_state does not exist in /proc/modules

ERROR: Module ipt_tcpmss does not exist in /proc/modules

ERROR: Module ipt_tos does not exist in /proc/modules

ERROR: Module ipt_ttl does not exist in /proc/modules

ERROR: Module iptable_filter does not exist in /proc/modules

ERROR: Module iptable_mangle does not exist in /proc/modules

ERROR: Module iptable_nat does not exist in /proc/modules

Then I decided to modprobe all those by hand (I have time!) and they all gave no errors (except for this is already loaded errors). As a result I have lots of modules loaded and shorewall still won't start.

----------

## Tii

I decided to go unstable and emerged the 1.4.10b version of shorewall (the newest in portage). And it friggin works! My guess is that the stable version doesn't play well with the iptables version that I have (newest stable). It would be nice to know if this is something specific to my configuration or maybe  bug of some sort.

----------

## steveb

i have the following one:

```
# qpkg -I -nc -v shorewall ; qpkg -I -nc -v iptables

net-firewall/shorewall-1.4.7c

net-firewall/iptables-1.2.9
```

and it works.

cheers

SteveB

----------

## Tii

Then it's probably some kind of thing specific to what I have installed and maybe my hardware. Or maybe not the hardware. It would have been interesting to know if you have that file it complained about in your computer but you're probably not reading this anymore. Anyway thanks for the help!

----------

## GamesBond

Do you have a 2.6 kernel and logunclean or dropunclean specified in your interfaces file?

Both options are not supported in kernel 2.6 and if specified they cause shorewall 1.4.x to fail on startup.

----------

