# firehol problems

## flazz

my firehol.conf: 

```
version 5

interface eth0 internet

          policy drop

          protection full

          server ssh accept

          server http accept

          server custom tsm tcp/1500 default accept

          server custom tsm tcp/1581 default accept

          client all accept

```

until an upgrade firehol seemed to work fine, now when i do a 

```
/etc/init.d/firehol/start
```

 i get

here are the errors: 25 of them

```

--------------------------------------------------------------------------------

WARNING : This might or might not affect the operation of your firewall.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line FIN of /etc/firehol/firehol.conf

COMMAND : /sbin/modprobe ip_conntrack -q 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 1.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 18 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -A in_internet -m state --state INVALID -j DROP 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 2.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 18 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A in_internet -p tcp -m state --state NEW ! --syn -j pr_internet_nosyn 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 3.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 19 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A in_internet_ssh_s1 -p tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 4.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 19 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A out_internet_ssh_s1 -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 5.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 20 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A in_internet_http_s2 -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 6.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 20 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A out_internet_http_s2 -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 7.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 21 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A in_internet_tsm_s3 -p tcp --sport 1024:65535 --dport 1500 -m state --state NEW,ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 8.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 21 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A out_internet_tsm_s3 -p tcp --sport 1500 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 9.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 22 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A in_internet_tsm_s4 -p tcp --sport 1024:65535 --dport 1581 -m state --state NEW,ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 10.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 22 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A out_internet_tsm_s4 -p tcp --sport 1581 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 11.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 25 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A out_internet_all_c5 -m state --state NEW,ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 12.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 25 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A in_internet_all_c5 -m state --state ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 13.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 25 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A out_internet_irc_c6 -p tcp --sport 32768:61000 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 14.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 25 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A in_internet_irc_c6 -p tcp --sport 6667 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 15.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 25 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A out_internet_ftp_c7 -p tcp --sport 32768:61000 --dport ftp -m state --state NEW,ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 25 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A in_internet_ftp_c7 -p tcp --sport ftp --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 17.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 25 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A in_internet_ftp_c7 -p tcp --sport ftp-data --dport 32768:61000 -m state --state ESTABLISHED,RELATED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 18.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 25 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A out_internet_ftp_c7 -p tcp --sport 32768:61000 --dport ftp-data -m state --state ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 19.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 25 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A out_internet_ftp_c7 -p tcp --sport 32768:61000 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 20.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line 25 of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A in_internet_ftp_c7 -p tcp --sport 1024:65535 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 21.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line FIN of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A in_internet -m state --state RELATED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 22.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line FIN of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A out_internet -m state --state RELATED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 23.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line FIN of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A INPUT -m state --state RELATED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 24.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line FIN of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A OUTPUT -m state --state RELATED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

ERROR   : # 25.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line FIN of /etc/firehol/firehol.conf

COMMAND : /sbin/iptables -t filter -A FORWARD -m state --state RELATED -j ACCEPT 

OUTPUT  : 

--------------------------------------------------------------------------------

WARNING : This might or might not affect the operation of your firewall.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line FIN of /etc/firehol/firehol.conf

COMMAND : /sbin/modprobe ip_conntrack_irc -q 

OUTPUT  : 

--------------------------------------------------------------------------------

WARNING : This might or might not affect the operation of your firewall.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line FIN of /etc/firehol/firehol.conf

COMMAND : /sbin/modprobe ip_conntrack_ftp -q 

OUTPUT  : 

                                                                          [ !! ]
```

any ideas on what is going wrong?

----------

## Algenon

Flazz,

I've got a similar problem, but mine seems to be related to upgrading the kernel to 2.6.20-r7 (from 2.6.19-r5).  When I run:

```
firehol try
```

 I get

```
FireHOL: Saving your old firewall to a temporary file: OK

FireHOL: Processing file /etc/firehol/firehol.conf: OK

FireHOL: Activating new firewall (117 rules):

--------------------------------------------------------------------------------

WARNING : This might or might not affect the operation of your firewall.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line FIN of /etc/firehol/firehol.conf

COMMAND : /sbin/modprobe ip_conntrack_irc -q 

OUTPUT  : 

--------------------------------------------------------------------------------

WARNING : This might or might not affect the operation of your firewall.

WHAT    : A runtime command failed to execute (returned error 1).

SOURCE  : line FIN of /etc/firehol/firehol.conf

COMMAND : /sbin/modprobe ip_conntrack_ftp -q 

OUTPUT  : 

 OK

Keep the firewall? (type 'commit' to accept - 30 seconds timeout) : no

FireHOL: Restoring old firewall: OK

```

I have tried various combinations of kernel configuration, the best seems to be when I set

```
Networking -> Networking Options -> Network Packet Filtering Framework-> Core Netfilter Configuration to all built-in (*) and 

Networking -> Networking Options -> Network Packet Filtering Framework->IP: Netfilter Configuration to all built-in (*).
```

I have tried other combinations of * and M to no avail.  My previous kernel and config seem ok.  What is worse is that my printer is connected to the router and this no longer works (presumeably due to this problem).

Regards,

Algenon.

----------

## flazz

confirmed on another machine, i upgraded from 2.6.18 to 2.6.20, same problems

----------

## Algenon

Hmmm.  Not sure how we should pursue this one.  If it is a genuine bug, then it would seem to be repeatable.  Lets see if anyone else can sheds some light on the subject.  Until then, I'm running with the old kernel.

Regards

Algenon.

p.s. 2.6.20 also seems to completely lock the machine when running VMware eventhough it was recompiled against the 2.6.20 kernel.  I have never had to hit the reset button on Gentoo before!

----------

## acarstoiu

Take a look at this bug.

----------

## Algenon

I solved mine by unmerging firehol and installing firestarter.  Seems to work ok and is easy to use.

Algenon.

----------

## ktsaou

Please use firehol v1.256 by doing:

```

# echo "net-firewall/firehol" >>/etc/portage/package.keywords

```

Then, emerge it again.

FireHOL 1.250 is not compatible with BASH 3.2 and kernels 2.6.20+.

FireHOL 1.256 is.

Costa

----------

## acarstoiu

Actually it's not a matter of compatibility, but of kernel configuration. I run firehol-1.250-r2 with kernel 2.6.21 and bash 3.2.

See above the link I provided to a bug discussion.

----------

## ktsaou

Yes, I have replied to this bug report, with this text:

 *Quote:*   

> 
> 
> Hi,
> 
> FireHOL v1.256 works with BASH 3.2 and kernels 2.6.20+.
> ...

 

----------

