Attachment 873264 Details for Bug 1074427 – A log of firewalld experiments

A log of firewalld experiments

firewalld.txt (text/plain), 18.04 KB, created by Mitch Davis on 2014-03-12 00:19:05 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mitch Davis

Created: 2014-03-12 00:19:05 UTC

Size: 18.04 KB

patch

obsolete

>Script started on Wed 12 Mar 2014 11:05:46 AM EST
>[root@green log]# > /var/log/firewalld 
>[root@green log]# rpm -q firewalld
>firewalld-0.3.3-2.fc19.noarch
>[root@green log]# systemctl status firewalld
>firewalld.service - firewalld - dynamic firewall daemon
>   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)
>   Active: inactive (dead) since Wed 2014-03-12 11:04:27 EST; 3min 14s ago
>  Process: 11724 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS)
>  Process: 18788 ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS (code=exited, status=0/SUCCESS)
>
>Mar 12 11:03:51 green.hackvana.com systemd[1]: Started firewalld - dynamic f....
>Mar 12 11:04:24 green.hackvana.com systemd[1]: Stopping firewalld - dynamic ....
>Mar 12 11:04:27 green.hackvana.com systemd[1]: Stopped firewalld - dynamic f....
>[root@green log]# systemctl start firewalld
>[root@green log]# firewall-cmd --state
>running
>[root@green log]# cat /var/log/firewalld
>2014-03-12 11:07:49 WARNING: home: COMMAND_FAILED
>2014-03-12 11:07:50 WARNING: internal: COMMAND_FAILED
>[root@green log]# systemctl stop firewalld
>[root@green log]# firewalld --nofork --debug
>2014-03-12 11:08:57 DEBUG1: start()
>2014-03-12 11:08:58 DEBUG1: Loading firewalld config file '/etc/firewalld/firewalld.conf'
>2014-03-12 11:08:59 DEBUG1: Loading lockdown whitelist
><firewall.core.fw_policies.FirewallPolicies instance at 0x1853ab8>
>2014-03-12 11:08:59 DEBUG1: Loading icmptype file '/usr/lib/firewalld/icmptypes/destination-unreachable.xml'
>2014-03-12 11:08:59 DEBUG1: Loading icmptype file '/usr/lib/firewalld/icmptypes/echo-reply.xml'
>2014-03-12 11:08:59 DEBUG1: Loading icmptype file '/usr/lib/firewalld/icmptypes/echo-request.xml'
>2014-03-12 11:08:59 DEBUG1: Loading icmptype file '/usr/lib/firewalld/icmptypes/parameter-problem.xml'
>2014-03-12 11:08:59 DEBUG1: Loading icmptype file '/usr/lib/firewalld/icmptypes/redirect.xml'
>2014-03-12 11:08:59 DEBUG1: Loading icmptype file '/usr/lib/firewalld/icmptypes/router-advertisement.xml'
>2014-03-12 11:08:59 DEBUG1: Loading icmptype file '/usr/lib/firewalld/icmptypes/router-solicitation.xml'
>2014-03-12 11:08:59 DEBUG1: Loading icmptype file '/usr/lib/firewalld/icmptypes/source-quench.xml'
>2014-03-12 11:08:59 DEBUG1: Loading icmptype file '/usr/lib/firewalld/icmptypes/time-exceeded.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/amanda-client.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/bacula-client.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/bacula.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/cluster-suite.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/dhcpv6-client.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/dns.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/ftp.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/http.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/https.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/imaps.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/ipp-client.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/ipp.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/ipsec.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/kerberos.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/kpasswd.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/ldap.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/ldaps.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/libvirt-tls.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/libvirt.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/mdns.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/mountd.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/ms-wbt.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/mysql.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/nfs.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/ntp.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/openvpn.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/pop3s.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/postgresql.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/radius.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/rpc-bind.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/samba-client.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/samba.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/smtp.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/ssh.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/telnet.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/tftp-client.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/tftp.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/transmission-client.xml'
>2014-03-12 11:08:59 DEBUG1: Loading service file '/usr/lib/firewalld/services/vnc-server.xml'
>2014-03-12 11:08:59 DEBUG1: Loading zone file '/usr/lib/firewalld/zones/block.xml'
>2014-03-12 11:08:59 DEBUG1: Loading zone file '/usr/lib/firewalld/zones/dmz.xml'
>2014-03-12 11:08:59 DEBUG1: Loading zone file '/usr/lib/firewalld/zones/drop.xml'
>2014-03-12 11:08:59 DEBUG1: Loading zone file '/usr/lib/firewalld/zones/external.xml'
>2014-03-12 11:09:00 DEBUG1: Loading zone file '/usr/lib/firewalld/zones/home.xml'
>2014-03-12 11:09:00 WARNING: home: COMMAND_FAILED
>2014-03-12 11:09:00 DEBUG1: Loading zone file '/usr/lib/firewalld/zones/internal.xml'
>2014-03-12 11:09:01 WARNING: internal: COMMAND_FAILED
>2014-03-12 11:09:01 DEBUG1: Loading zone file '/usr/lib/firewalld/zones/public.xml'
>2014-03-12 11:09:01 DEBUG1: Loading zone file '/usr/lib/firewalld/zones/trusted.xml'
>2014-03-12 11:09:01 DEBUG1: Loading zone file '/usr/lib/firewalld/zones/work.xml'
>2014-03-12 11:09:01 DEBUG1: Loading zone file '/etc/firewalld/zones/public.xml'
>2014-03-12 11:09:01 DEBUG1:   Overloads zone 'public' ('/usr/lib/firewalld/zones/public.xml')
>2014-03-12 11:09:02 DEBUG1: Using default zone 'public'
>2014-03-12 11:09:03 DEBUG1: config.IcmpTypeAdded('redirect')
>2014-03-12 11:09:03 DEBUG1: config.IcmpTypeAdded('router-solicitation')
>2014-03-12 11:09:03 DEBUG1: config.IcmpTypeAdded('parameter-problem')
>2014-03-12 11:09:03 DEBUG1: config.IcmpTypeAdded('destination-unreachable')
>2014-03-12 11:09:03 DEBUG1: config.IcmpTypeAdded('echo-request')
>2014-03-12 11:09:03 DEBUG1: config.IcmpTypeAdded('echo-reply')
>2014-03-12 11:09:03 DEBUG1: config.IcmpTypeAdded('source-quench')
>2014-03-12 11:09:03 DEBUG1: config.IcmpTypeAdded('time-exceeded')
>2014-03-12 11:09:03 DEBUG1: config.IcmpTypeAdded('router-advertisement')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('cluster-suite')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('kpasswd')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('bacula-client')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('smtp')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('ipp')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('radius')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('mysql')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('ms-wbt')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('bacula')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('transmission-client')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('ftp')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('mdns')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('samba')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('dhcpv6-client')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('rpc-bind')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('ldaps')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('https')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('ldap')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('imaps')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('samba-client')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('kerberos')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('http')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('dns')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('ntp')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('vnc-server')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('telnet')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('libvirt')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('openvpn')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('ssh')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('ipsec')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('postgresql')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('ipp-client')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('amanda-client')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('mountd')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('tftp-client')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('nfs')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('tftp')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('pop3s')
>2014-03-12 11:09:03 DEBUG1: config.ServiceAdded('libvirt-tls')
>2014-03-12 11:09:03 DEBUG1: config.ZoneAdded('block')
>2014-03-12 11:09:03 DEBUG1: config.ZoneAdded('work')
>2014-03-12 11:09:03 DEBUG1: config.ZoneAdded('drop')
>2014-03-12 11:09:03 DEBUG1: config.ZoneAdded('internal')
>2014-03-12 11:09:03 DEBUG1: config.ZoneAdded('external')
>2014-03-12 11:09:03 DEBUG1: config.ZoneAdded('home')
>2014-03-12 11:09:03 DEBUG1: config.ZoneAdded('dmz')
>2014-03-12 11:09:03 DEBUG1: config.ZoneAdded('public')
>2014-03-12 11:09:03 DEBUG1: config.ZoneAdded('trusted')
>^C2014-03-12 11:09:44 Stopping..
>2014-03-12 11:09:44 DEBUG1: stop()
>[root@green log]# 
>[root@green log]# cat /usr/lib/firewalld/zones/home.xml
><?xml version="1.0" encoding="utf-8"?>
><zone>
>  <short>Home</short>
>  <description>For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
>  <service name="ssh"/>
>  <service name="ipp-client"/>
>  <service name="mdns"/>
>  <service name="samba-client"/>
>  <service name="dhcpv6-client"/>
></zone>
>[root@green log]# cat /usr/lib/firewalld/zones/internal.xml
><?xml version="1.0" encoding="utf-8"?>
><zone>
>  <short>Internal</short>
>  <description>For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.</description>
>  <service name="ssh"/>
>  <service name="ipp-client"/>
>  <service name="mdns"/>
>  <service name="samba-client"/>
>  <service name="dhcpv6-client"/>
></zone>
>[root@green log]# rpm -V firewalld
>[root@green log]# yum update -y firewalld
>
>updates/19/x86_64/metalink                               |  16 kB     00:00     
>
>updates                                                  | 4.7 kB     00:00     
>
>updates/19/x86_64/primary_ 0% [                 ]  0.0 B/s |    0 B   --:-- ETA 
>
>updates/19/x86_64/primary_ 7% [=                ]  0.0 B/s | 820 kB   --:-- ETA 
>
>updates/19/x86_64/primary_ 43% [=======         ] 6.2 MB/s | 4.7 MB   00:00 ETA 
>
>updates/19/x86_64/primary_ 70% [===========     ] 6.4 MB/s | 7.6 MB   00:00 ETA 
>
>updates/19/x86_64/primary_ 92% [==============- ] 6.5 MB/s |  10 MB   00:00 ETA 
>
>updates/19/x86_64/primary_db                               |  11 MB   00:01     
>
>(1/2): updates/19/x86_64/updateinfo                0.0 B/s |    0 B   00:00     
>
>(1/2): updates/19/x86_64/updateinfo                        | 1.1 MB   00:00     
>
>(2/2): updates/19/x86_64/ 122% [================]  0.0 B/s | 1.3 MB   --:-- ETA 
>
>(2/2): updates/19/x86_64/pkgtags                           | 997 kB   00:00     
>Resolving Dependencies
>--> Running transaction check
>---> Package firewalld.noarch 0:0.3.3-2.fc19 will be updated
>---> Package firewalld.noarch 0:0.3.9.3-1.fc19 will be an update
>--> Finished Dependency Resolution
>
>Dependencies Resolved
>
>================================================================================
> Package           Arch           Version                 Repository       Size
>================================================================================
>Updating:
> firewalld         noarch         0.3.9.3-1.fc19          updates         470 k
>
>Transaction Summary
>================================================================================
>Upgrade  1 Package
>
>Total download size: 470 k
>Downloading packages:
>Not downloading deltainfo for updates, MD is 2.2 M and rpms are 470 k
>
>firewalld-0.3.9.3-1.fc19.n 0% [                 ]  0.0 B/s |    0 B   --:-- ETA 
>
>firewalld-0.3.9.3-1.fc19.noarch.rpm                        | 470 kB   00:01     
>Running transaction check
>Running transaction test
>Transaction test succeeded
>Running transaction
>
>  Updating   : firewalld-0.3.9.3-1.fc19.noarch                              1/2 
>
>  Cleanup    : firewalld-0.3.3-2.fc19.noarch                                2/2 
>
>  Verifying  : firewalld-0.3.9.3-1.fc19.noarch                              1/2 
>
>  Verifying  : firewalld-0.3.3-2.fc19.noarch                                2/2 
>
>Updated:
>  firewalld.noarch 0:0.3.9.3-1.fc19                                             
>
>Complete!
>[root@green log]# systemctl start firewalld.service
>[root@green log]# systemctl status firewalld.service
>firewalld.service - firewalld - dynamic firewall daemon
>   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)
>   Active: [1;32mactive (running)[0m since Wed 2014-03-12 11:11:27 EST; 24s ago
> Main PID: 20775 (firewalld)
>   CGroup: name=systemd:/system/firewalld.service
>           ââ20775 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid
>
>Mar 12 11:11:25 green.hackvana.com systemd[1]: Starting firewalld - dynamic ....
>Mar 12 11:11:27 green.hackvana.com systemd[1]: Started firewalld - dynamic f....
>[root@green log]# firewall-cmd --state
>[91mnot running[00m
>[root@green log]# systemctl stop firewalld
>[root@green log]# > /var/log/firewalld
>[root@green log]# firewall-cmd --state
>[91mnot running[00m
>[root@green log]# firewalld --nofork --debug
>2014-03-12 11:13:10 DEBUG1: start()
>2014-03-12 11:13:11 DEBUG1: Loading firewalld config file '/etc/firewalld/firewalld.conf'
>2014-03-12 11:13:11 DEBUG1: IPv6 rpfilter is enabled
>2014-03-12 11:13:13 Traceback (most recent call last):
>  File "/usr/lib/python2.7/site-packages/firewall/server/decorators.py", line 40, in handle_exceptions
>    return func(*args, **kwargs)
>  File "/usr/lib/python2.7/site-packages/firewall/server/firewalld.py", line 77, in start
>    return self.fw.start()
>  File "/usr/lib/python2.7/site-packages/firewall/core/fw.py", line 248, in start
>    self._start()
>  File "/usr/lib/python2.7/site-packages/firewall/core/fw.py", line 158, in _start
>    self._apply_default_rules()
>  File "/usr/lib/python2.7/site-packages/firewall/core/fw.py", line 530, in _apply_default_rules
>    self.rule("ipv6", rule)
>  File "/usr/lib/python2.7/site-packages/firewall/core/fw.py", line 579, in rule
>    return self._ip6tables.set_rule(rule)
>  File "/usr/lib/python2.7/site-packages/firewall/core/ipXtables.py", line 140, in set_rule
>    return self.__run(rule)
>  File "/usr/lib/python2.7/site-packages/firewall/core/ipXtables.py", line 136, in __run
>    " ".join(_args), ret))
>ValueError: '/sbin/ip6tables -t raw -I PREROUTING 2 -m rpfilter --invert -j DROP' failed: ip6tables: No chain/target/match by that name.
>
>^C2014-03-12 11:13:31 Stopping..
>2014-03-12 11:13:31 DEBUG1: stop()
>[root@green log]# yum downgrade firewalld
>Resolving Dependencies
>--> Running transaction check
>---> Package firewalld.noarch 0:0.3.3-2.fc19 will be a downgrade
>---> Package firewalld.noarch 0:0.3.9.3-1.fc19 will be erased
>--> Finished Dependency Resolution
>
>Dependencies Resolved
>
>================================================================================
> Package            Arch            Version               Repository       Size
>================================================================================
>Downgrading:
> firewalld          noarch          0.3.3-2.fc19          fedora          313 k
>
>Transaction Summary
>================================================================================
>Downgrade  1 Package
>
>Total download size: 313 k
>Is this ok [y/d/N]: y
>Downloading packages:
>
>firewalld-0.3.3-2.fc19.noa 0% [                 ]  0.0 B/s |    0 B   --:-- ETA 
>
>firewalld-0.3.3-2.fc19.noarch.rpm                          | 313 kB   00:00     
>Running transaction check
>Running transaction test
>Transaction test succeeded
>Running transaction
>
>  Installing : firewalld-0.3.3-2.fc19.noarch                                1/2 
>
>  Cleanup    : firewalld-0.3.9.3-1.fc19.noarch                              2/2 
>
>  Verifying  : firewalld-0.3.3-2.fc19.noarch                                1/2 
>
>  Verifying  : firewalld-0.3.9.3-1.fc19.noarch                              2/2 
>
>Removed:
>  firewalld.noarch 0:0.3.9.3-1.fc19                                             
>
>Installed:
>  firewalld.noarch 0:0.3.3-2.fc19                                               
>
>Complete!
>[root@green log]# systemctl start firewalld
>[root@green log]# systemctl status firewalld
>firewalld.service - firewalld - dynamic firewall daemon
>   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)
>   Active: [1;32mactive (running)[0m since Wed 2014-03-12 11:15:04 EST; 12s ago
> Main PID: 21334 (firewalld)
>   CGroup: name=systemd:/system/firewalld.service
>           ââ21334 /usr/bin/python /usr/sbin/firewalld --nofork --nopid
>
>Mar 12 11:15:04 green.hackvana.com systemd[1]: Started firewalld - dynamic f....
>[root@green log]# firewall-cmd --state
>running
>[root@green log]# exit
>
>Script done on Wed 12 Mar 2014 11:15:26 AM EST

Actions: View

Attachments on bug 1074427: 873264 | 873265 | 875039 | 875051