Development issues regarding the cerowrt test router project
 help / color / mirror / Atom feed
* [Cerowrt-devel] [Bug #445] doesn't load firewall rules under some circumstances
@ 2014-07-30 20:46 Dave Taht
  2014-07-30 20:52 ` Ranga Krishnan
  0 siblings, 1 reply; 2+ messages in thread
From: Dave Taht @ 2014-07-30 20:46 UTC (permalink / raw)
  To: cerowrt-devel, cerowrt

[-- Attachment #1: Type: text/plain, Size: 1115 bytes --]

I usually kill off the firewall rules for an internal router almost
completely. Recently, I didn't do that, and didn't have the external
interface connected, so  a new cerowrt-3.10.50-1 install automagically
meshed with another router over wifi.

...and didn't run the default firewall rules at all.

I first noticed that /etc/firewall.user wasn't run (which is the lousy
place I'm using to export the /24 local network via babel), so I didn't
have connectivity to the next hop mesh... and then I
checked to see there were no iptables rules in place at all. So, some

trigger for running the firewall "fw3 load" doesn't run unless there is an
external ethernet interface up in cerowrt.

And arguably it should run pretty early. So somewhere there is a missing
trigger?? to load the fw...

(and I hope this is a cerowrt specific bug and it did use to work)

... and I'd really rather run this out of /etc/config/network somehow

ip route add unreachable my.subnet.add.ress/24


-- 
Dave Täht

NSFW:
https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article

[-- Attachment #2: Type: text/html, Size: 4267 bytes --]

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [Cerowrt-devel] [Bug #445] doesn't load firewall rules under some circumstances
  2014-07-30 20:46 [Cerowrt-devel] [Bug #445] doesn't load firewall rules under some circumstances Dave Taht
@ 2014-07-30 20:52 ` Ranga Krishnan
  0 siblings, 0 replies; 2+ messages in thread
From: Ranga Krishnan @ 2014-07-30 20:52 UTC (permalink / raw)
  To: Dave Taht; +Cc: cerowrt, cerowrt-devel

[-- Attachment #1: Type: text/plain, Size: 1877 bytes --]

I have seen this happen and others working on the EFF router have 
experienced this somewhat rare but persistent problem of firewall 
rules not loading.

I have seen mention of this problem on OpenWRT mailing lists
as far back as 3 years ago. Looks like the problem is documented
but has not been fixed. 

I am just going to add 

/etc/init.d/firewall restart

in /etc/rc.local to act as a backup until this is properly resolved. 

Ranga


On Jul 30, 2014, at 1:46 PM, Dave Taht <dave.taht@gmail.com> wrote:

> I usually kill off the firewall rules for an internal router almost
> completely. Recently, I didn't do that, and didn't have the external
> interface connected, so  a new cerowrt-3.10.50-1 install automagically
> meshed with another router over wifi.
> 
> ...and didn't run the default firewall rules at all.
> 
> I first noticed that /etc/firewall.user wasn't run (which is the lousy
> place I'm using to export the /24 local network via babel), so I didn't
> have connectivity to the next hop mesh... and then I
> checked to see there were no iptables rules in place at all. So, some
> 
> trigger for running the firewall "fw3 load" doesn't run unless there is an
> external ethernet interface up in cerowrt.
> 
> And arguably it should run pretty early. So somewhere there is a missing
> trigger?? to load the fw...
> 
> (and I hope this is a cerowrt specific bug and it did use to work)
> 
> ... and I'd really rather run this out of /etc/config/network somehow
> 
> ip route add unreachable my.subnet.add.ress/24
> 
> 
> -- 
> Dave Täht
> 
> NSFW: https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article
> _______________________________________________
> Cerowrt-devel mailing list
> Cerowrt-devel@lists.bufferbloat.net
> https://lists.bufferbloat.net/listinfo/cerowrt-devel


[-- Attachment #2: Type: text/html, Size: 5551 bytes --]

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2014-07-30 20:52 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-07-30 20:46 [Cerowrt-devel] [Bug #445] doesn't load firewall rules under some circumstances Dave Taht
2014-07-30 20:52 ` Ranga Krishnan

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox