Linux IPCHAINS HOWTO

6. Common Problems

6.1 ipchains -L Freezes!

You're probably blocking DNS lookups; it will eventually time out. Try using the `-n' (numeric) flag to ipchains, which suppresses the lookup of names.

6.2 Inverse doesn't work!

You must put the `!' option by itself, with spaces either side. A classic mistake (warned about in 1.3.10) is:

# ipchains -A input -i !eth0 -j DENY
#

There will never be an interface called `!eth0', but ipchains doesn't know that.

6.3 Masquerading/Forwarding Doesn't Work!

Make sure that packet forwarding is enabled (in recent kernels it is disabled by default, meaning that packets never even try to traverse the `forward' chain). You can override this (as root) by typing

# echo 1 > /proc/sys/net/ipv4/ip_forward
#

If this works for you, you can put this somewhere in your bootup scripts so it is enabled every time; you'll want to set up your firewalling before this command runs though, otherwise there's an opportunity for packets to slip through.

6.4 -j REDIR doesn't work!

You must allow forwarding packets (see above) for redirect to work; otherwise the routing code drops the packet. So if you are just using redirect, and don't have any forwarding at all, you should be aware of that.

Note that REDIR (being in the input chain) doesn't effect connections from a local process.

6.5 Wildcard Interfaces Don't Work!

There was a bug in versions 2.1.102 and 2.1.103 of the kernel (and some old patches I produced) which made ipchains commands which specified a wildcard interface (such as -i ppp+) fail.

This is fixed in recent kernels, and in the 2.0.34 patch on the web site. You can also fix it by hand in the kernel source by changing line 63 or so in include/linux/ip_fw.h:

#define IP_FW_F_MASK    0x002F  /* All possible flag bits mask   */

This should read ``0x003F''. Fix this and recompile the kernel.

6.6 TOS Doesn't Work!

This was my mistake: setting the Type of Service field did not actually set the Type of Service in kernel versions 2.1.102 through 2.1.111. This problem was fixed in 2.1.112.

6.7 ipautofw and ipportfw Don't Work!

For 2.0.x, this is true; I haven't time to create and maintain a jumbo patch for ipchains and ipautofw/ipportfw.

For 2.1.x, download Juan Ciarlante's ipmasqadm from

<url url="http://juanjox.linuxhq.com/"
        name="http://juanjox.linuxhq.com/">

6.8 xosview is Broken!

Upgrade to version 1.6.0 or above, which doesn't require any firewall rules at all for 2.1.x kernels. This seems to have broken again in the 1.6.1 release; please bug the author (it's not my fault!).

6.9 Segmentation Fault With `-j REDIRECT'!

This was a bug in ipchains version 1.3.3. Please upgrade.

6.10 I Can't Set Masquerading Timeouts!

True (for 2.1.x kernels) up to 2.1.123. In 2.1.124, trying to set the masquerading timeouts causes a kernel lockup (change return to ret = on line 1328 of net/ipv4/ip_fw.c). In 2.1.125, it works fine.

6.11 I Want to Firewall IPX!

So do a number of others, it seems. My code only covers IP, unfortunately. On the good side, all the hooks are there to firewall IPX! You just need to write the code; I will happily help where possible.