# ip_tables and Ndiswrapper problems

## LebenOjanen

Hey, I've searched through lots of ndiswrapper posts here and I haven't found anything pertaining to my problem, so here goes...

I'm trying to setup a firewall on my machine, and after installing both GuardDog and KMyFirewall (wanted to test each for features, etc) I finally found out that ip_tables wasn't configured when I originally ran genkernel.

So, I popped genkernel back up, and activated DeviceDrivers-> Networking Support-> Networking Options-> Network Packet Filtering (replaces ip_chains).  I decided to look deeper and I noticed that there was a feature for ip_tables support about two levels down.  So once I enabled it, I again noticed that some of the (NEW) features under it were things that GuardDog asked for (and recieved errors for) in it's scripts. (things to do with mangling and whatnot). So, I

figured to be safe I'd enable them all.

Well After recompiling the kernel, everything booted fine, BUT when activating my wireless card via ndiswrapper, the kernel dropped an error and my system froze. I'm sorry I don't remember the exact error, it just mentioned something about modules, but after GenKerneling again, disabling Network Packet Filtering, and recompiling, everything worked just fine. 

Does anyone have any clue what's going on? Or would you guys like me to reply to this with the exact messages, after I recompile like I previously did?

----------

## jmbsvicetto

It would be helpful to have a bit more info.

What wireless card are you using? What driver are you using with ndiswrapper? What features did you enable in the packet filtering screen? What kernel are you using? Oh, and what's the exact error that you get?

----------

## LebenOjanen

The machine is a Dell Inspiron 1000 Laptop, the wireless card is a Dell Truemobile 1300 (Broadcom).  The bcmwl5 drivers work, via ndiswrapper. The Kernel is 2.6.11-gentoo-r11.  As for the features, I tried going back and just enabling Network Packet Filtering and ip_table support, still crashed on me as soon as I tried loading ndiswrapper.

As for the error ... how can I capture the error other than writing it down? The system freezes as soon as the error's spit out.

I'll be here for the next 5 hours, monitoring, so I'll reply pretty much instantly.

----------

## jmbsvicetto

If you could write the error down, particularly the not being able to load the module ... , it might be helpful.

----------

## LebenOjanen

ok >< gimmie about 30 mins to go recompile, get error, then recompile and come back here

----------

## jmbsvicetto

OK, before going that road, these two bugs reported at https://bugs.gentoo.org might interest you:

https://bugs.gentoo.org/show_bug.cgi?id=95584

https://bugs.gentoo.org/show_bug.cgi?id=92404

Although in your case it seems you can use ndiswrapper as long as you don't enable iptables, right?

----------

## LebenOjanen

Exactly. 

The irony doesn't go unnoticed.  Ndiswrapper = Internet.   Internet means I need a Firewall.  Firewall needs ip_tables. ip_tables makes Ndiswrapper die.  I guess, in a sense, it's the best firewall you could have =P no connection to the net at all is the most secure. Heh

----------

## LebenOjanen

Ok, I just noticed something.  I have a script that loads ndiswrapper and configures my iwconfig stuffs then launches /etc/init.d/net.wlan0 stop/start.  That way I don't have to do it by hand every time I want to get onto my home ad-hoc network.

Interesting thing = modprobe ndiswrapper works fine, although once it crashed when I typed it ....  anyway this time it didn't die until I typed /etc/init.d/net.wlan0 start myself

The error is as follow... *Grumbles for having to type so much*

```

Oops: 0002 [#1]

Modules linked in: ndiswrapper snd_pcm_oss snd_mixer_oss snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd snd_page_alloc sata_via sata_svw sata_sil sata_promise libata dm_mod sbp2 ohci1394 ieee1394 ohci_hcd uhci_hcd usb_storage usbhid echi_hcd usb_core

CPU:       0

EIP:        0060:[<d0c875f9>]       Tainted:  P        VLI

EFLAGS:  00010207   (2.6.11-gentoo-r11)

EIP is at NdisMIndicateReceivePacket +0x99/0x360  [ndiswrapper]

eax:  0000002a    ebx: cbab8480    ecx:  0000000a     edx:  cbe28220

esi:   cbbc783a     edi:  00000010   ebp:  cbbd030c      esp:  c121fcb0

ds:  007b     es:  007b    ss:  0078

Process events/0 (pid: 3, threadinfo=c121e000 task=c11f6020)

Stack: c121e000 00000000 cb54dbbc cbab98d8 cbab9800 c0000009a c121fcf0 d0cd0bdd

      cbe28220 c121fcf8 00000001 cbbc7fd4 c121fe82 cbbf0000 cbbd030c 00000000

      c121fe6c d0ce68bb cb54dbbc 00000000 cbb7fd4 cbbc7800 cbbc7fd4 00000001

Call Trace:

 [<c02cd9d4>] bit_putcs+0x364/0x570

 [<c02dee13>] fbcon_sis_sync+0x23/0x40

 [<c02fc419>] cfb_imageblit+0x5f9/0x620

 [<d0c8621d>] NdisAllocateBuffer+0x9d/0x1e0 [ndiswrapper]

 [<d0c85d20>] NdisAcquireSpinLock+0x0/0x80 [ndiswrapper]

 [<d0c87040>] ndis_irq_bh+0x0/0xc0 [ndiswrapper]

 [<d0c870a2>] ndis_irq_bh+0x62/0xc0 [ndiswrapper]

 [<c012899b>] worker_thread+0x17b/0x220

 [<c0118120>] default_wake_function+0x0/0x20

 [<c03fdf6f>] schedule+0x28f/0x4b0

 [<c0118120>] default_wake_function+0x-/0x20

 [<c0128820>] worker_thread+0x0/0x220

 [<c012c183>] kthread+0xa3/0xb0

 [<c012c0e0>] kthread+0x0/0xb0

 [<c01012b5>] kernel_thread_helper+0x5/0x10

Code: 83 c7 10 89 b8 8c 00 00 00 83 80 90 00 00 00 10 8b 54 24 20 8b 54 24 20 8b 82 6c 02 00 00 89 43 18 8b 45 14 8b 75 18 89 c1 03 75 10 c1 e9 02 <f3> a5 a8 02 74 02 66 a5 a8 01 74 01 a4 8b 7b 64 85 ff 8b 55 14

<0> Kernel panic - not syncing: Fatal exception in interrupt

```

Yes, I typed it all by hand, yes it came out looking wierd as hell. Get over it! =D hehe That took me forever ><

and while I wait, I'm going to take some people's advice on another post in this forum and re-emerge iptables

----------

## LebenOjanen

I enabled just ip_tables and NetFilter and after loading that kernel I reinstalled ndiswrapper.  Poof, it works now.  Great!  ALright, so now all that's left to do is load up the ip_tables modules (I'm going to load em all, just because a few of the ones required by KMyFirewall are a bit ... sketchy and I can't seem to find em) We'll see what happens! Will edit this with the results!

--UPDATE--

Alright, everthing seems to work just fine. I just needed to INSTALL NDISWRAPPER AFTER RECOMPILING THE KERNEL WITH IP_TABLES (for anyone who might have the same problem and be searching for the solution.  Also, if you're setting up KMyFirewall, save yourself about an hour or more of recompiling your kernel and just turn on every friggin option and suboption in or around ip_tables. Then turn on syncookies too.. Ok?

Btw, thanks for the help jmbsvicetto, I owe ya a beer  :Smile: 

----------

## jmbsvicetto

I'm glad that you were able to solve your problem and that I help you a little.

----------

## digitalshepard

Good afternoon.

I'm trying to do the exact same thing, with sadly the same kernel panic error.  I was wondering if you would clarify what exactly "that kernel" is.   

 *Quote:*   

> I enabled just ip_tables and NetFilter and after loading that kernel I reinstalled ndiswrapper. Poof, it works now. Great! ALright, so now all that's left to do is load up the ip_tables modules (I'm going to load em all, just because a few of the ones required by KMyFirewall are a bit ... sketchy and I can't seem to find em) We'll see what happens! Will edit this with the results!
> 
> 

 

----------

## jmbsvicetto

If I understood it correctly, after compiling the kernel with support for iptables and netfilter and rebooting the system using this kernel, you have to reemerge ndiswrapper. I think LebenOjanen said that was all it took.

----------

## tutaepaki

Think you'll find you need to re-emerge ndiswrapper after any kernel re-compilation.

----------

## digitalshepard

Possibly a silly question, but where do I enable 'netfilter'.  After running 

```
 make menuconfig 
```

 I followed DeviceDrivers-> Networking Support-> Networking Options-> Network Packet Filtering (replaces ip_chains).  and enabled that.  After only enabling that I got the same 

```
 

<0> Kernel panic - not syncing: Fatal exception in interrupt 
```

 error.  If I enable netfilter will it get around the error, or do I have to get rid of ndiswrapper, if so, how?  Right now all I have is wireless internet, no ndiswrapper = no internet. Will I have to wait till I can get to a hardwire internet connection?

thanks for such a quick reply

----------

## tutaepaki

I've found recently, that after building a new kernel, it's safest to comment out ndiswrapper from my /etc/modules.autoload.d/kernel-2.6 file...reboot with the new kernel....re-emerge ndiswrapper...and then load ndis wrapper again and uncomment.

I'm not sure when it started happening, 1 or 2 kernels ago I think, but this panic seems to be a regular occurance after building a new kernel. It used to just fail to load ndis wrapper.

you should be able to re-emerge ndiswrapper without a network connection, as the dist file should already be present.

----------

## digitalshepard

I had to go through a lot of trial and error to get ndiswrapper working.  it is already commented out under /etc/modules.autoload.d/kernel-2.6, but there is an enter under /etc/modprobe.conf :

```
alias wlan0 ndiswrapper
```

  Should I comment that out?  Where else should I look?

----------

