Changing green interface using CLI?

Support
,
1

NethServer Version: 7.5
Module: base system

My backup neth server, which is acting as a hotsync target, has three network interfaces–one is green (which had been a 10G interface), the other two are unused. I needed to remove the 10G NIC/cable and use a different interface. Powered down, removed cable, plugged in a network cable to one of the other interfaces, and did db networks setprop enp0s25 ipaddr blah gateway blah netmask blah role green followed by signal-event interface-update. That didn’t quite work, so I also did db networks delprop those same properties on the old interface followed by another signal-event interface-update. That seemed to do the trick–I could ping in and out, ssh in, pull up the server manager, etc.

However, I was still getting error messages from hotsync. Figuring that maybe the new interface wasn’t fully configured, I went to the server manager, Networks page, edited the configuration of this interface, changed nothing, and clicked save. Big problems:

image
image.png495×652 83.4 KB

Not sure what’s up at this point. Server manager still works, SSH still works, but hotsync is still throwing an error every 15 minutes. Thoughts?

2

Firewall rules are empty?
Are network segments correctly configure into network section?
Do firewall know that interfaces are changed?

3

I hadn’t installed the firewall, AFAIK. I tried rebooting, and that’s stopped the hotsync error messages, but now I get this message on the dashboard:

image

There’s clearly more reconfiguration needed–but I can’t see where it would be.

4

Is there Samba4 AD account provider configured? Then the green interface has to be bridged to be able to host the NSDC container. This could get you in trouble when you change the nic… (just a thought)

5

No, the accounts provider is local LDAP.

6

Maybe the service status tells us something:

systemctl status shorewall -l

Does a signal-event firewall-adjust help? It should (re)start/reconfigure the firewall.

7 
[root@neth-backup ~]# systemctl status shorewall -l
● shorewall.service - Shorewall IPv4 firewall
   Loaded: loaded (/usr/lib/systemd/system/shorewall.service; enabled; vendor preset: disabled)
  Drop-In: /usr/lib/systemd/system/shorewall.service.d
           └─nethserver-firewall-base.conf
   Active: failed (Result: exit-code) since Sat 2018-11-03 19:44:12 EDT; 21h ago
 Main PID: 4623 (code=exited, status=25)

Nov 03 19:44:12 neth-backup.familybrown.org shorewall[4623]: Processing /etc/shorewall/shorewall.conf...
Nov 03 19:44:12 neth-backup.familybrown.org shorewall[4623]: Loading Modules...
Nov 03 19:44:12 neth-backup.familybrown.org shorewall[4623]: Compiling /etc/shorewall/zones...
Nov 03 19:44:12 neth-backup.familybrown.org shorewall[4623]: Compiling /etc/shorewall/interfaces...
Nov 03 19:44:12 neth-backup.familybrown.org shorewall[4623]: Compiling /etc/shorewall/hosts...
Nov 03 19:44:12 neth-backup.familybrown.org shorewall[4623]: ERROR: Unknown interface (enp2s0) /etc/shorewall/hosts (line 21)
Nov 03 19:44:12 neth-backup.familybrown.org systemd[1]: shorewall.service: main process exited, code=exited, status=25/n/a
Nov 03 19:44:12 neth-backup.familybrown.org systemd[1]: Failed to start Shorewall IPv4 firewall.
Nov 03 19:44:12 neth-backup.familybrown.org systemd[1]: Unit shorewall.service entered failed state.
Nov 03 19:44:12 neth-backup.familybrown.org systemd[1]: shorewall.service failed.

Doesn’t appear to have. shorewall status doesn’t appear changed.

I wonder if this is the problem: /etc/shorewall/hosts is referring to the old interface, not the new. OTOH, /etc/shorewall/interfaces is referring to the new interface. Making the changes manually to /etc/shorewall/hosts lets shorewall start, but of course that will be overwritten next time the template is expanded. And I’m afraid I can’t parse the Perl in the hosts template fragment to understand what it’s doing. Here’s the output of db networks show:

[root@neth-backup hosts]# db networks show
192.168.3.0=network
    Description=VPN network
    Mask=255.255.255.0
eno1=ethernet
enp0s25=ethernet
    FwInBandwidth=
    FwOutBandwidth=
    bootproto=none
    gateway=192.168.1.1
    ipaddr=192.168.1.60
    netmask=255.255.255.0
    role=green
enp2s0=ethernet
    FwInBandwidth=
    FwOutBandwidth=
    bootproto=none
ppp0=xdsl-disabled
    AuthType=auto
    FwInBandwidth=
    FwOutBandwidth=
    Password=
    name=PPPoE
    provider=xDSL provider
    role=red
    user=
[root@neth-backup hosts]#

enp0s25 is the new interface; enp2s0 is the old.

8

I compared to my servers and I recognized that all interfaces have a role prop even if it’s empty.
And I think the bootproto for enp2s0 could be deleted.

db networks delprop enp2s0 bootproto
db networks setprop enp2s0 role ''
signal-event interface-update
signal-event firewall-adjust

My networks db to compare:

[root@testserver ~]# db networks show
ens33=ethernet
    FwInBandwidth=
    FwOutBandwidth=
    bootproto=none
    gateway=192.168.0.1
    ipaddr=192.168.0.2
    netmask=255.255.255.0
    role=green
ens37=ethernet
    role=
ens38=ethernet
    role=
2 Likes
9

This seems to have done it. Shorewall is running, and the warning is gone from the web GUI. Thanks for the help.

1 Like