Sam Varshavchik writes:
The first thing that I noticed after updating my router to F32 is that masquerading didn't seem to work. telnet to some public port 80 appears to be blocked, traceroute dies, etc…When I ran firewall-config, the masquerading checkbox was off, so I enabled it, but it made no difference.Poking around suggested that something more fundamental is broken, somewhere. firewall-config itself seems to be showing my two interfaces: wan0 (eno2) Zone: FedoraServer lan0 (eno1) Zone: FedoraServerThis is correct, my ports, both in the zone. But firewall-cmd on the command line comes back with this:[root@shorty ~]# firewall-cmd --list-interfaces [root@shorty ~]# firewall-cmd --get-active-zone [root@shorty ~]#Something seems to be broken in firewalld-land, but I don't know where to start looking.
Following up to myself, firewall seems to be choking on startup, I found this in syslog, and the same error occurs when I try to reload firewalld from firewall-cmd:
May 16 18:13:41 shorty firewalld[1006]: ERROR: COMMAND_FAILED: 'python- nftables' failed: internal:0:0-0: Error: Could not process rule: File exists#012#012internal:0:0-0: Error: Could not process rule: File exists#012#012internal:0:0-0: Error: Could not process rule: File exists#012#012#012JSON blob:#012{"nftables": [{"metainfo": {"json_schema_version": 1}}, {"add": {"set": {"family": "inet", "table": "firewalld", "name": "chinanet", "type": "ipv4_addr", "flags": ["interval"]}}}, {"add": {"set": {"family": "ip", "table": "firewalld", "name": "chinanet", "type": "ipv4_addr", "flags": ["interval"]}}}, {"add": {"set": {"family": "ip6", "table": "firewalld", "name": "chinanet", "type": "ipv4_addr", "flags": ["interval"]}}}, {"flush": {"set": {"family": "inet", "table": "firewalld", "name": "chinanet"}}}, {"flush": {"set": {"family": "ip", "table": "firewalld", "name": "chinanet"}}}, {"flush": {"set": {"family": "ip6", "table": "firewalld", "name": "chinanet"}}}, {"add": {"element": {"family": "inet", "table": "firewalld", "name": "chinanet", "elem": [{"prefix": {"addr": "221.224.0.0", "len": 13}}]}}}, {"add": {"element": {"family": "ip", "table": "firewalld", "name": "chinanet", "elem": [{"prefix": {"addr": "221.224.0.0", "len": 13}}]}}}, {"add": {"element": {"family": "ip6", "table": "firewalld", "name": "chinanet", "elem": [{"prefix": {"addr": "221.224.0.0", "len": 13}}]}}}, {"add": {"element": {"family": "inet", "table": "firewalld", "name": "chinanet", "elem": [{"prefix": {"addr": "119.84.0.0", "len": 14}}]}}}, {"add": {"element": {"family": "ip", "table": "firewalld", "name": "chinanet", "elem": [{"prefix": {"addr": "119.84.0.0", "len": 14}}]}}}, {"add": {"element": {"family": "ip6", "table": "firewalld", "name": "chinanet", "elem": [{"prefix": {"addr": "119.84.0.0", "len": 14}}]}}}, {"add": {"element": {"family": "inet", "table": "firewalld", "name": "chinanet", "elem": [{"prefix": {"addr": "61.169.0.0", "len": 16}}]}}}, {"add": {"element": {"family": "ip", "table": "firewalld", "name": "chinanet", "elem": [{"prefix": {"addr": "61.169.0.0", "len":
And systemctl shows the same:May 16 19:00:08 shorty.email-scan.com systemd[1]: Reloaded firewalld - dynamic firewall daemon. May 16 19:00:08 shorty.email-scan.com firewalld[1006]: ERROR: 'python- nftables' failed:
JSON blob:
{"nftables":
[{"metainfo": {"json_schema_version": 1}}, {"add": {"table": {"family":
"inet", "name": "firewalld_policy_drop"}}}, {"add": {"chain": {"family":
"inet", "table": "firewalld_policy_drop", "name": "filter_input", "type":
"filter", "hook": "input", "prio": 9, "policy": "drop"}}}, {"add": {"chain":
{"family": "inet", "table": "firewalld_policy_drop", "name":
"filter_forward", "type": "filter", "hook": "forward", "prio": 9, "policy":
"drop"}}}, {"add": {"chain": {"family": "inet", "table":
"firewalld_policy_drop", "name": "filter_output", "type": "filter", "hook":
"output", "prio": 9, "policy": "drop"}}}, {"add": {"rule": {"family":
"inet", "table": "firewalld_policy_drop", "chain": "filter_input", "expr":
[{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set":
["established", "related"]}}}, {"accept": null}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld_policy_drop", "chain":
"filter_forward", "expr": [{"match": {"left": {"ct": {"key": "state"}},
"op": "in", "right": {"set": ["established", "related"]}}}, {"accept":
null}]}}}, {"add": {"rule": {"family": "inet", "table":
"firewalld_policy_drop", "chain": "filter_output", "expr": [{"match":
{"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set":
["established", "related"]}}}, {"accept": null}]}}}]}
This is eminently Bugzilla-ble.
Attachment:
pgpBQLQjz69kH.pgp
Description: PGP signature
_______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
