Firewall is not running

Support
,
1

NethServer Version: 7.4
Module: shorewall / docker

Hi everyone

found an error on my samba server
Check rules, firewall is NOT running

with

 shorewall: WARNING: There are entries in /etc/shorewall/tcpri but /etc/shorewall/tcinterfaces was empty /etc/shorewall/tcpri (line 20)
shorewall: iptables-restore: line 130 failed
shorewall: ERROR: iptables-restore Failed. Input is in /var/lib/shorewall/.iptables-restore-input

on line 130 i found it

-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 9000 -j ACCEPT
-A DOCKER-ISOLATION -j RETURN

idea?
Thank you

2

How did you install docker? Did you add some template-custom? Did you check out a dev package? You could try

 systemctl stop docker
 shorewall stop
 shorewall start
3

hi @davidep, i have install docker from @stephdl repos

next time I have solved with remove and reinstallation of all docker package

After a latest docker-ce update ( docker-ce-18.03.1 ) and new firewall rule insert, same error on NS Web gui.

Task completed with errors
Configuring shorewall #29 (exit status 1)
Compiling using Shorewall 5.1.10.2...
Processing /etc/shorewall/params ...
Processing /etc/shorewall/shorewall.conf...
Loading Modules...
Compiling /etc/shorewall/zones...
Compiling /etc/shorewall/interfaces...
Compiling /etc/shorewall/hosts...
Determining Hosts in Zones...
Locating Action Files...
Compiling /etc/shorewall/policy...
Running /etc/shorewall/initdone...
Adding Anti-smurf Rules
Adding rules for DHCP
Compiling TCP Flags filtering...
Compiling Kernel Route Filtering...
Compiling Martian Logging...
Compiling MAC Filtration -- Phase 1...
Compiling /etc/shorewall/rules...
Compiling /etc/shorewall/conntrack...
Compiling MAC Filtration -- Phase 2...
Applying Policies...
Compiling /etc/shorewall/tcpri...
WARNING: There are entries in /etc/shorewall/tcpri but /etc/shorewall/tcinterfaces was empty /etc/shorewall/tcpri (line 20)
Generating Rule Matrix...
Optimizing Ruleset...
Creating iptables-restore input...
Compiling /etc/shorewall/stoppedrules...
Shorewall configuration compiled to /var/lib/shorewall/.restart
Shorewall is not running
Starting Shorewall....
Initializing...
Processing /etc/shorewall/init ...
Processing /etc/shorewall/tcclear ...
Setting up Route Filtering...
Setting up Martian Logging...
Setting up Proxy ARP...
Preparing iptables-restore input...
Running /sbin/iptables-restore --wait 60...
iptables-restore: line 142 failed
ERROR: iptables-restore Failed. Input is in /var/lib/shorewall/.iptables-restore-input
Processing /etc/shorewall/stop ...
Processing /etc/shorewall/tcclear ...
Preparing iptables-restore input...
Running /sbin/iptables-restore --wait 60...
iptables-restore: line 73 failed
ERROR: /sbin/iptables-restore --wait 60 Failed.
IPv4 Forwarding Enabled
Processing /etc/shorewall/stopped ...
/usr/share/shorewall/lib.common: line 93: 374871 Terminated $SHOREWALL_SHELL $script $options $@

after that

May 09 13:51:51 samba shorewall[2676]: iptables-restore: line 126 failed
May 09 13:51:51 samba shorewall[2676]: ERROR: iptables-restore Failed. Input is in /var/lib/shorewall/.iptables-restore-input
May 09 13:51:51 samba logger[2947]: ERROR:Shorewall start failed

line 126 contain

-A DOCKER-ISOLATION -j RETURN

now i have removed package
yum remove nethserver-portainer nethserver-docker docker-ce

in /var/log/messages found
iptables-restore v1.4.21: Couldn't load target 'dock_frwd':No such file or directory

and now
yum install docker-ce-17.12.1.ce-1.el7.centos.x86_64.rpm nethserver-portainer-0.1.4-1.ns7.noarch.rpm nethserver-docker-0.1.4-1.ns7.noarch.rpm

systemctl status shorewall.service
â—Ź shorewall.service - Shorewall IPv4 firewall
   Loaded: loaded (/usr/lib/systemd/system/shorewall.service; enabled; vendor preset: disabled)
  Drop-In: /usr/lib/systemd/system/shorewall.service.d
           └─nethserver-firewall-base.conf
   Active: active (exited) since Wed 2018-05-09 14:03:29 CEST; 22s ago
4

we plan another way for docker and nethserver, use docker container via a bridge (internal network) and get rid of TCP port…need time on it

5

I suggest to remove the experimental packages and disable the Docker flag in shorewall

 config setprop firewall Docker disabled
 shorewall clear
 signal-event firewall-adjust
3 Likes
6

thank you guys!!!

7

@sharpec look at my change shorewall ->becomes-> firewall