Linux Netfilter discussions
 help / color / mirror / Atom feed
* netfilter hangups
@ 2003-03-11 22:00 Chip Upsal
  2003-03-11 22:15 ` ...
  2003-03-12  5:51 ` Alexander W. Janssen
  0 siblings, 2 replies; 6+ messages in thread
From: Chip Upsal @ 2003-03-11 22:00 UTC (permalink / raw)
  To: 'netfilter@lists.netfilter.org'

I am running nefilter 1.2.7a on a Redhat 7.3 box kernel v. 2.4.18-24.7.x.

I have experienced the following problems. Sometimes after making many
changes and reloading the firewall after each change...the firewall will
refuse to reload with the following output:

[root@iptables1 root]# /etc/sysconfig/iptables condrestart
iptables: Chain already exists
iptables: Chain already exists
iptables: Chain already exists
iptables: Chain already exists
iptables: Chain already exists

Or if i get no error the firewall will not recognize any of the changes i
have made.

In either case i am forced to reboot the firewall to get things going again.



Chip Upsal
SysAdmin


^ permalink raw reply	[flat|nested] 6+ messages in thread
* RE: netfilter hangups
@ 2003-03-11 23:27 Chip Upsal
  2003-03-12  8:12 ` Rob Sterenborg
  0 siblings, 1 reply; 6+ messages in thread
From: Chip Upsal @ 2003-03-11 23:27 UTC (permalink / raw)
  To: '...', netfilter

Could the way i am restarting it cause it to refuse to honor new rules w/o
rebooting?

-----Original Message-----
From: ... [mailto:betolourenco@ig.com.br]
Sent: Tuesday, March 11, 2003 3:15 PM
To: netfilter@lists.netfilter.org
Subject: Re: netfilter hangups


why are you doing it.

try
service iptables restart

...
----- Original Message -----
From: "Chip Upsal" <cupsal@cyberwolf.com>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, March 11, 2003 7:00 PM
Subject: netfilter hangups


> I am running nefilter 1.2.7a on a Redhat 7.3 box kernel v. 2.4.18-24.7.x.
>
> I have experienced the following problems. Sometimes after making many
> changes and reloading the firewall after each change...the firewall will
> refuse to reload with the following output:
>
> [root@iptables1 root]# /etc/sysconfig/iptables condrestart
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
>
> Or if i get no error the firewall will not recognize any of the changes i
> have made.
>
> In either case i am forced to reboot the firewall to get things going
again.
>
>
>
> Chip Upsal
> SysAdmin
>
>



^ permalink raw reply	[flat|nested] 6+ messages in thread
* RE: netfilter hangups
@ 2003-03-17 16:10 Chip Upsal
  0 siblings, 0 replies; 6+ messages in thread
From: Chip Upsal @ 2003-03-17 16:10 UTC (permalink / raw)
  To: 'Alexander W. Janssen'; +Cc: netfilter

The script has the flush scripts. However sometimes it will not flush the
tables. A suggestion posted earlier fixed the problem. Instead of using the
init.d script directly i used service (service iptables restart) and the
script ran as expected. 

I cannot figure out why the flush scripts fail to run from time to time. But
it has happened more the once.

Chip

-----Original Message-----
From: Alexander W. Janssen [mailto:alexander.janssen@gmx.de]
Sent: Tuesday, March 11, 2003 10:52 PM
To: Netfilter Mailinglist
Subject: Re: netfilter hangups


On Tue, Mar 11, 2003 at 03:00:20PM -0700, Chip Upsal wrote:
> [root@iptables1 root]# /etc/sysconfig/iptables condrestart
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists
> iptables: Chain already exists

The error is, what is says. If you create a custom chain with the -N switch
and fill it with data, the following can happen:

castor:~# iptables -N bla                   # New chain
castor:~# iptables -A bla -j REJECT         # some rule
castor:~# iptables -X bla                   # try to delete
iptables: Chain is not empty                # doesn't work. surprise
castor:~# iptables -N bla                   # that seems to be your problem
iptables: Chain already exists              # oh, well...
castor:~# iptables -F bla                   # flush the chain
castor:~# iptables -X bla                   # delete it
castor:~# iptables -N bla                   # be a lucky boy
castor:~# echo $?
0                                           # yeah, baby

 
> Or if i get no error the firewall will not recognize any of the changes i
> have made.

What i gues what happens is that:

1. Create chain
2. Fill chain
3.1. Try to delete chain without flushing it first -> will fail
3.2. Forget to delete chain
4. Try to create chain -> chain allready exists
5. Fill chain with rules -> since the chain was never flushed, it just keeps
up filling with rules

> In either case i am forced to reboot the firewall to get things going
again.

Na, i don't think so. Look into your script into the "stop" section (i don't
really know that script, but SYSV-init-style scripts should be the same
everywhere). Look if you custom created chains are getting flushed and
deleted. If they arent't do it there. Save. Try.

If it doesn't work: Send the script.

> Chip Upsal
> SysAdmin

Alex.

-- 
"Mr Data, when I said 'Fire at Will', I didn't mean for you to be so
literal."
Instructions for use of this post: Insert tounge in cheek. Read as normal.


^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2003-03-17 16:10 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-03-11 22:00 netfilter hangups Chip Upsal
2003-03-11 22:15 ` ...
2003-03-12  5:51 ` Alexander W. Janssen
  -- strict thread matches above, loose matches on Subject: below --
2003-03-11 23:27 Chip Upsal
2003-03-12  8:12 ` Rob Sterenborg
2003-03-17 16:10 Chip Upsal

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox