* netfilter hangups
@ 2003-03-11 22:00 Chip Upsal
2003-03-11 22:15 ` ...
2003-03-12 5:51 ` Alexander W. Janssen
0 siblings, 2 replies; 6+ messages in thread
From: Chip Upsal @ 2003-03-11 22:00 UTC (permalink / raw)
To: 'netfilter@lists.netfilter.org'
I am running nefilter 1.2.7a on a Redhat 7.3 box kernel v. 2.4.18-24.7.x.
I have experienced the following problems. Sometimes after making many
changes and reloading the firewall after each change...the firewall will
refuse to reload with the following output:
[root@iptables1 root]# /etc/sysconfig/iptables condrestart
iptables: Chain already exists
iptables: Chain already exists
iptables: Chain already exists
iptables: Chain already exists
iptables: Chain already exists
Or if i get no error the firewall will not recognize any of the changes i
have made.
In either case i am forced to reboot the firewall to get things going again.
Chip Upsal
SysAdmin
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: netfilter hangups
2003-03-11 22:00 netfilter hangups Chip Upsal
@ 2003-03-11 22:15 ` ...
2003-03-12 5:51 ` Alexander W. Janssen
1 sibling, 0 replies; 6+ messages in thread
From: ... @ 2003-03-11 22:15 UTC (permalink / raw)
To: netfilter
why are you doing it.
try
service iptables restart
...
----- Original Message -----
From: "Chip Upsal" <cupsal@cyberwolf.com>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, March 11, 2003 7:00 PM
Subject: netfilter hangups
> I am running nefilter 1.2.7a on a Redhat 7.3 box kernel v. 2.4.18-24.7.x.
>
> I have experienced the following problems. Sometimes after making many
> changes and reloading the firewall after each change...the firewall will
> refuse to reload with the following output:
>
> [root@iptables1 root]# /etc/sysconfig/iptables condrestart
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
>
> Or if i get no error the firewall will not recognize any of the changes i
> have made.
>
> In either case i am forced to reboot the firewall to get things going
again.
>
>
>
> Chip Upsal
> SysAdmin
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: netfilter hangups
@ 2003-03-11 23:27 Chip Upsal
2003-03-12 8:12 ` Rob Sterenborg
0 siblings, 1 reply; 6+ messages in thread
From: Chip Upsal @ 2003-03-11 23:27 UTC (permalink / raw)
To: '...', netfilter
Could the way i am restarting it cause it to refuse to honor new rules w/o
rebooting?
-----Original Message-----
From: ... [mailto:betolourenco@ig.com.br]
Sent: Tuesday, March 11, 2003 3:15 PM
To: netfilter@lists.netfilter.org
Subject: Re: netfilter hangups
why are you doing it.
try
service iptables restart
...
----- Original Message -----
From: "Chip Upsal" <cupsal@cyberwolf.com>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, March 11, 2003 7:00 PM
Subject: netfilter hangups
> I am running nefilter 1.2.7a on a Redhat 7.3 box kernel v. 2.4.18-24.7.x.
>
> I have experienced the following problems. Sometimes after making many
> changes and reloading the firewall after each change...the firewall will
> refuse to reload with the following output:
>
> [root@iptables1 root]# /etc/sysconfig/iptables condrestart
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
>
> Or if i get no error the firewall will not recognize any of the changes i
> have made.
>
> In either case i am forced to reboot the firewall to get things going
again.
>
>
>
> Chip Upsal
> SysAdmin
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: netfilter hangups
2003-03-11 22:00 netfilter hangups Chip Upsal
2003-03-11 22:15 ` ...
@ 2003-03-12 5:51 ` Alexander W. Janssen
1 sibling, 0 replies; 6+ messages in thread
From: Alexander W. Janssen @ 2003-03-12 5:51 UTC (permalink / raw)
To: Netfilter Mailinglist
[-- Attachment #1: Type: text/plain, Size: 2072 bytes --]
On Tue, Mar 11, 2003 at 03:00:20PM -0700, Chip Upsal wrote:
> [root@iptables1 root]# /etc/sysconfig/iptables condrestart
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
The error is, what is says. If you create a custom chain with the -N switch
and fill it with data, the following can happen:
castor:~# iptables -N bla # New chain
castor:~# iptables -A bla -j REJECT # some rule
castor:~# iptables -X bla # try to delete
iptables: Chain is not empty # doesn't work. surprise
castor:~# iptables -N bla # that seems to be your problem
iptables: Chain already exists # oh, well...
castor:~# iptables -F bla # flush the chain
castor:~# iptables -X bla # delete it
castor:~# iptables -N bla # be a lucky boy
castor:~# echo $?
0 # yeah, baby
> Or if i get no error the firewall will not recognize any of the changes i
> have made.
What i gues what happens is that:
1. Create chain
2. Fill chain
3.1. Try to delete chain without flushing it first -> will fail
3.2. Forget to delete chain
4. Try to create chain -> chain allready exists
5. Fill chain with rules -> since the chain was never flushed, it just keeps
up filling with rules
> In either case i am forced to reboot the firewall to get things going again.
Na, i don't think so. Look into your script into the "stop" section (i don't
really know that script, but SYSV-init-style scripts should be the same
everywhere). Look if you custom created chains are getting flushed and
deleted. If they arent't do it there. Save. Try.
If it doesn't work: Send the script.
> Chip Upsal
> SysAdmin
Alex.
--
"Mr Data, when I said 'Fire at Will', I didn't mean for you to be so literal."
Instructions for use of this post: Insert tounge in cheek. Read as normal.
[-- Attachment #2: Type: application/pgp-signature, Size: 248 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: netfilter hangups
2003-03-11 23:27 Chip Upsal
@ 2003-03-12 8:12 ` Rob Sterenborg
0 siblings, 0 replies; 6+ messages in thread
From: Rob Sterenborg @ 2003-03-12 8:12 UTC (permalink / raw)
To: netfilter
> Could the way i am restarting it cause it to refuse to honor
> new rules w/o rebooting?
<snip>
> > [root@iptables1 root]# /etc/sysconfig/iptables condrestart
> > iptables: Chain already exists
> > iptables: Chain already exists
> > iptables: Chain already exists
> > iptables: Chain already exists
> > iptables: Chain already exists
Yes.
If the script doesn't delete the user-defined chains first and then
tries to create new ones with the same name you get this error.
Rob
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: netfilter hangups
@ 2003-03-17 16:10 Chip Upsal
0 siblings, 0 replies; 6+ messages in thread
From: Chip Upsal @ 2003-03-17 16:10 UTC (permalink / raw)
To: 'Alexander W. Janssen'; +Cc: netfilter
The script has the flush scripts. However sometimes it will not flush the
tables. A suggestion posted earlier fixed the problem. Instead of using the
init.d script directly i used service (service iptables restart) and the
script ran as expected.
I cannot figure out why the flush scripts fail to run from time to time. But
it has happened more the once.
Chip
-----Original Message-----
From: Alexander W. Janssen [mailto:alexander.janssen@gmx.de]
Sent: Tuesday, March 11, 2003 10:52 PM
To: Netfilter Mailinglist
Subject: Re: netfilter hangups
On Tue, Mar 11, 2003 at 03:00:20PM -0700, Chip Upsal wrote:
> [root@iptables1 root]# /etc/sysconfig/iptables condrestart
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
The error is, what is says. If you create a custom chain with the -N switch
and fill it with data, the following can happen:
castor:~# iptables -N bla # New chain
castor:~# iptables -A bla -j REJECT # some rule
castor:~# iptables -X bla # try to delete
iptables: Chain is not empty # doesn't work. surprise
castor:~# iptables -N bla # that seems to be your problem
iptables: Chain already exists # oh, well...
castor:~# iptables -F bla # flush the chain
castor:~# iptables -X bla # delete it
castor:~# iptables -N bla # be a lucky boy
castor:~# echo $?
0 # yeah, baby
> Or if i get no error the firewall will not recognize any of the changes i
> have made.
What i gues what happens is that:
1. Create chain
2. Fill chain
3.1. Try to delete chain without flushing it first -> will fail
3.2. Forget to delete chain
4. Try to create chain -> chain allready exists
5. Fill chain with rules -> since the chain was never flushed, it just keeps
up filling with rules
> In either case i am forced to reboot the firewall to get things going
again.
Na, i don't think so. Look into your script into the "stop" section (i don't
really know that script, but SYSV-init-style scripts should be the same
everywhere). Look if you custom created chains are getting flushed and
deleted. If they arent't do it there. Save. Try.
If it doesn't work: Send the script.
> Chip Upsal
> SysAdmin
Alex.
--
"Mr Data, when I said 'Fire at Will', I didn't mean for you to be so
literal."
Instructions for use of this post: Insert tounge in cheek. Read as normal.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2003-03-17 16:10 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-03-11 22:00 netfilter hangups Chip Upsal
2003-03-11 22:15 ` ...
2003-03-12 5:51 ` Alexander W. Janssen
-- strict thread matches above, loose matches on Subject: below --
2003-03-11 23:27 Chip Upsal
2003-03-12 8:12 ` Rob Sterenborg
2003-03-17 16:10 Chip Upsal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox