Description of problem: When using the firewalld GUI and the Fedora Workstation profile I am unable to successfully add samba to the policy. Checking the smb box produces an error as follows: INVALID_HELPER: nf_conntrack_netbios_ns not available in kernel. However, as a workaround, I switched to the Fedora Server profile and was able to successfully add samba.
On further check, the situation seems to be more serious. Samba cannot be accessed from the network when firewalld is running, disabling firewalld allows access. Will see if I can gather some additional info.
Iptables output does not show that firewalld has inserted a rule for samba, ie ports 139/tcp, 445/tcp, etc. Now I also see that trying to uncheck samba from the FedoraServer policy also triggers the error as above. I next used firewalld to create an samba-workaround object with the proper ports, then reloaded firewalld. Reload of firewalld also shows: Nov 16 19:53:13 ears.private firewalld[3934]: WARNING: INVALID_HELPER: 'nf_conntrack_netbios_ns' not available in kernel I next selected samba-workaround in the FedoraServer policy and it created the rules in iptables. Issue worked around but obviously a serious problem for anyone running firewalld and samba. The issue began today after a dnf upgrade: Nov 16 12:32:52 DEBUG ---> Package firewalld.noarch 0.4.3.3-1.fc24 will be upgraded Nov 16 12:32:52 DEBUG ---> Package firewalld.noarch 0.4.4.1-1.fc24 will be an upgrade Nov 16 12:32:52 DEBUG ---> Package firewalld-filesystem.noarch 0.4.3.3-1.fc24 will be upgraded Nov 16 12:32:52 DEBUG ---> Package firewalld-filesystem.noarch 0.4.4.1-1.fc24 will be an upgrade
ftp also affected with similar error, unable to load nf_conntrack_ftp, not in kernel.
Modprobe of modules prior to starting firewalld does not help.
Added info: A "systemctl status firewalld" results in: Nov 17 11:21:55 bilbo systemd[1]: Starting firewalld - dynamic firewall daemon... Nov 17 11:22:01 bilbo systemd[1]: Started firewalld - dynamic firewall daemon. Nov 17 11:22:15 bilbo firewalld[724]: WARNING: INVALID_HELPER: 'nf_conntrack_ftp' not available in kernel Nov 17 11:22:17 bilbo firewalld[724]: WARNING: INVALID_HELPER: 'nf_conntrack_netbios_ns' not available in kernel
Identical issue on Fedora 24 kernel 4.8.8-200.fc24.armv7hl Upgraded: Nov 21 10:21:22 DEBUG ---> Package firewall-config.noarch 0.4.3.3-1.fc24 will be upgraded Nov 21 10:21:22 DEBUG ---> Package firewall-config.noarch 0.4.4.1-1.fc24 will be an upgrade Nov 21 10:21:22 DEBUG ---> Package firewalld.noarch 0.4.3.3-1.fc24 will be upgraded Nov 21 10:21:22 DEBUG ---> Package firewalld.noarch 0.4.4.1-1.fc24 will be an upgrade Nov 21 10:21:22 DEBUG ---> Package firewalld-filesystem.noarch 0.4.3.3-1.fc24 will be upgraded Nov 21 10:21:22 DEBUG ---> Package firewalld-filesystem.noarch 0.4.4.1-1.fc24 will be an upgrade
*** This bug has been marked as a duplicate of bug 1394597 ***