Sam Varshavchik writes:
The first thing that I noticed after updating my router to F32 is
that
masquerading didn't seem to work. telnet to some public port 80 appears to
be blocked, traceroute dies, etc…
When I ran firewall-config, the masquerading checkbox was off, so I enabled
it, but it made no difference.
Poking around suggested that something more fundamental is broken, somewhere.
firewall-config itself seems to be showing my two interfaces:
wan0 (eno2)
Zone: FedoraServer
lan0 (eno1)
Zone: FedoraServer
This is correct, my ports, both in the zone. But firewall-cmd on the command
line comes back with this:
[root@shorty ~]# firewall-cmd --list-interfaces
[root@shorty ~]# firewall-cmd --get-active-zone
[root@shorty ~]#
Something seems to be broken in firewalld-land, but I don't know where to
start looking.
Following up to myself, firewall seems to be choking on startup, I found
this in syslog, and the same error occurs when I try to reload firewalld
from firewall-cmd:
May 16 18:13:41 shorty firewalld[1006]: ERROR: COMMAND_FAILED: 'python-
nftables' failed: internal:0:0-0: Error: Could not process rule: File
exists#012#012internal:0:0-0: Error: Could not process rule: File
exists#012#012internal:0:0-0: Error: Could not process rule: File
exists#012#012#012JSON blob:#012{"nftables": [{"metainfo":
{"json_schema_version": 1}}, {"add": {"set":
{"family": "inet", "table":
"firewalld", "name": "chinanet", "type":
"ipv4_addr", "flags":
["interval"]}}}, {"add": {"set": {"family":
"ip", "table": "firewalld",
"name": "chinanet", "type": "ipv4_addr",
"flags": ["interval"]}}}, {"add":
{"set": {"family": "ip6", "table":
"firewalld", "name": "chinanet", "type":
"ipv4_addr", "flags": ["interval"]}}}, {"flush":
{"set": {"family": "inet",
"table": "firewalld", "name": "chinanet"}}},
{"flush": {"set": {"family":
"ip", "table": "firewalld", "name":
"chinanet"}}}, {"flush": {"set":
{"family": "ip6", "table": "firewalld",
"name": "chinanet"}}}, {"add":
{"element": {"family": "inet", "table":
"firewalld", "name": "chinanet",
"elem": [{"prefix": {"addr": "221.224.0.0",
"len": 13}}]}}}, {"add":
{"element": {"family": "ip", "table":
"firewalld", "name": "chinanet",
"elem": [{"prefix": {"addr": "221.224.0.0",
"len": 13}}]}}}, {"add":
{"element": {"family": "ip6", "table":
"firewalld", "name": "chinanet",
"elem": [{"prefix": {"addr": "221.224.0.0",
"len": 13}}]}}}, {"add":
{"element": {"family": "inet", "table":
"firewalld", "name": "chinanet",
"elem": [{"prefix": {"addr": "119.84.0.0",
"len": 14}}]}}}, {"add":
{"element": {"family": "ip", "table":
"firewalld", "name": "chinanet",
"elem": [{"prefix": {"addr": "119.84.0.0",
"len": 14}}]}}}, {"add":
{"element": {"family": "ip6", "table":
"firewalld", "name": "chinanet",
"elem": [{"prefix": {"addr": "119.84.0.0",
"len": 14}}]}}}, {"add":
{"element": {"family": "inet", "table":
"firewalld", "name": "chinanet",
"elem": [{"prefix": {"addr": "61.169.0.0",
"len": 16}}]}}}, {"add":
{"element": {"family": "ip", "table":
"firewalld", "name": "chinanet",
"elem": [{"prefix": {"addr": "61.169.0.0",
"len":
And systemctl shows the same:
May 16 19:00:08
shorty.email-scan.com systemd[1]: Reloaded firewalld -
dynamic firewall daemon.
May 16 19:00:08
shorty.email-scan.com firewalld[1006]: ERROR: 'python-
nftables' failed:
JSON blob:
{"nftables":
[{"metainfo": {"json_schema_version": 1}}, {"add":
{"table": {"family":
"inet", "name": "firewalld_policy_drop"}}},
{"add": {"chain": {"family":
"inet", "table": "firewalld_policy_drop", "name":
"filter_input", "type":
"filter", "hook": "input", "prio": 9,
"policy": "drop"}}}, {"add": {"chain":
{"family": "inet", "table":
"firewalld_policy_drop", "name":
"filter_forward", "type": "filter", "hook":
"forward", "prio": 9, "policy":
"drop"}}}, {"add": {"chain": {"family":
"inet", "table":
"firewalld_policy_drop", "name": "filter_output",
"type": "filter", "hook":
"output", "prio": 9, "policy": "drop"}}},
{"add": {"rule": {"family":
"inet", "table": "firewalld_policy_drop", "chain":
"filter_input", "expr":
[{"match": {"left": {"ct": {"key":
"state"}}, "op": "in", "right": {"set":
["established", "related"]}}}, {"accept": null}]}}},
{"add": {"rule":
{"family": "inet", "table":
"firewalld_policy_drop", "chain":
"filter_forward", "expr": [{"match": {"left":
{"ct": {"key": "state"}},
"op": "in", "right": {"set":
["established", "related"]}}}, {"accept":
null}]}}}, {"add": {"rule": {"family": "inet",
"table":
"firewalld_policy_drop", "chain": "filter_output",
"expr": [{"match":
{"left": {"ct": {"key": "state"}}, "op":
"in", "right": {"set":
["established", "related"]}}}, {"accept": null}]}}}]}
This is eminently Bugzilla-ble.