<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I have seen this happen and others working on the EFF router have <div>experienced this somewhat rare but persistent problem of firewall </div><div>rules not loading.<div><br></div><div>I have seen mention of this problem on OpenWRT mailing lists</div><div>as far back as 3 years ago. Looks like the problem is documented</div><div>but has not been fixed. </div><div><br></div><div>I am just going to add </div><div><br></div><div>/etc/init.d/firewall restart</div><div><br></div><div>in /etc/rc.local to act as a backup until this is properly resolved. </div><div><br></div><div>Ranga</div><div><br></div><div><br></div><div><div><div>On Jul 30, 2014, at 1:46 PM, Dave Taht <<a href="mailto:dave.taht@gmail.com">dave.taht@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr"><span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">I usually kill off the firewall rules for an internal router almost</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">completely. Recently, I didn't do that, and didn't have the external</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">interface connected, so a new cerowrt-3.10.50-1 install automagically</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">meshed with another router over wifi.</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">...and didn't run the default firewall rules at all.</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">I first noticed that /etc/firewall.user wasn't run (which is the lousy</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">place I'm using to export the /24 local network via babel), so I didn't</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">have connectivity to the next hop mesh... and then I</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"><span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">checked to see there were no iptables rules in place at all. So, some</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"><span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">trigger for running the firewall "fw3 load" doesn't run unless there is an</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">external ethernet interface up in cerowrt.</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">And arguably it should run pretty early. So somewhere there is a missing</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">trigger?? to load the fw...</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">(and I hope this is a cerowrt specific bug and it did use to work)</span><br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">
<br style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px"><span style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px">... and I'd really rather run this out of /etc/config/network somehow</span><div>
<font color="#500050" face="arial, sans-serif"><br></font></div><div><span style="font-family:arial,sans-serif;font-size:13px">ip route add unreachable my.subnet.add.ress/24</span></div><div><font face="arial, sans-serif"><br clear="all">
</font><div><br></div>-- <br>Dave Täht<br><br>NSFW: <a href="https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article" target="_blank">https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article</a>
</div></div>
_______________________________________________<br>Cerowrt-devel mailing list<br><a href="mailto:Cerowrt-devel@lists.bufferbloat.net">Cerowrt-devel@lists.bufferbloat.net</a><br>https://lists.bufferbloat.net/listinfo/cerowrt-devel<br></blockquote></div><br></div></div></body></html>