Re: [gentoo-user] iptables

[Holly Bostick]

John Dangler schreef:
> Holly~ The Firestarter kernel requirements doc says -
>
> *Device drivers *Networking support [y] *Networking support
> *Networking options *Network packet filtering [y] *Network packet
> filtering IP: Netfilter Configuration (*)
>
> "We recommend you enable _everything_ except ipchains support and
> ipfwadm support as modules under this menu"

I never read this as meaning that everything should be selected, but
rather that everything that you select under this menu, other than
ipchains support and ipfwadm, should be selected as a module rather than
static. But even then, they further explain that this is mostly to save
size and memory in the kernel, rather than some actual necessity.

And of course, the docs further say
> At the very least, the Connection tracking, IP tables, Connection
> state match support, Connection tracking match support, Packet
> filtering, Full NAT and the LOG target support


My config looks like this:

CONFIG_IP_NF_CONNTRACK=y
# CONFIG_IP_NF_CT_ACCT is not set
# CONFIG_IP_NF_CONNTRACK_MARK is not set
# CONFIG_IP_NF_CT_PROTO_SCTP is not set
# CONFIG_IP_NF_FTP is not set
# CONFIG_IP_NF_IRC is not set
# CONFIG_IP_NF_TFTP is not set
# CONFIG_IP_NF_AMANDA is not set
CONFIG_IP_NF_QUEUE=y
CONFIG_IP_NF_IPTABLES=y
CONFIG_IP_NF_MATCH_LIMIT=y
CONFIG_IP_NF_MATCH_IPRANGE=y
CONFIG_IP_NF_MATCH_MAC=y
CONFIG_IP_NF_MATCH_PKTTYPE=y
CONFIG_IP_NF_MATCH_MARK=y
CONFIG_IP_NF_MATCH_MULTIPORT=y
CONFIG_IP_NF_MATCH_TOS=y
CONFIG_IP_NF_MATCH_RECENT=y
CONFIG_IP_NF_MATCH_ECN=y
CONFIG_IP_NF_MATCH_DSCP=y
CONFIG_IP_NF_MATCH_AH_ESP=y
CONFIG_IP_NF_MATCH_LENGTH=y
CONFIG_IP_NF_MATCH_TTL=y
CONFIG_IP_NF_MATCH_TCPMSS=y
CONFIG_IP_NF_MATCH_HELPER=y
CONFIG_IP_NF_MATCH_STATE=y
CONFIG_IP_NF_MATCH_CONNTRACK=y
CONFIG_IP_NF_MATCH_OWNER=y
# CONFIG_IP_NF_MATCH_ADDRTYPE is not set
# CONFIG_IP_NF_MATCH_REALM is not set
# CONFIG_IP_NF_MATCH_SCTP is not set
# CONFIG_IP_NF_MATCH_COMMENT is not set
# CONFIG_IP_NF_MATCH_HASHLIMIT is not set
CONFIG_IP_NF_FILTER=y
CONFIG_IP_NF_TARGET_REJECT=y
CONFIG_IP_NF_TARGET_LOG=y
CONFIG_IP_NF_TARGET_ULOG=y
CONFIG_IP_NF_TARGET_TCPMSS=y
CONFIG_IP_NF_NAT=y
CONFIG_IP_NF_NAT_NEEDED=y
CONFIG_IP_NF_TARGET_MASQUERADE=y
CONFIG_IP_NF_TARGET_REDIRECT=y
CONFIG_IP_NF_TARGET_NETMAP=y
CONFIG_IP_NF_TARGET_SAME=y
# CONFIG_IP_NF_NAT_SNMP_BASIC is not set
CONFIG_IP_NF_MANGLE=y
CONFIG_IP_NF_TARGET_TOS=y
CONFIG_IP_NF_TARGET_ECN=y
CONFIG_IP_NF_TARGET_DSCP=y
CONFIG_IP_NF_TARGET_MARK=y
CONFIG_IP_NF_TARGET_CLASSIFY=y
CONFIG_IP_NF_RAW=m
CONFIG_IP_NF_TARGET_NOTRACK=m
CONFIG_IP_NF_ARPTABLES=y
CONFIG_IP_NF_ARPFILTER=y
CONFIG_IP_NF_ARP_MANGLE=y

As you see, I haven't even followed the instructions properly (all this
stuff is static), but, as the docs also say it will, Firestarter seems
to work fine (because all the 'required elements' are enabled.

Maybe I'll go back through make menuconfig and clean that all up, just
so I know what I'm doing in future. But afaik, I just left the kernel
defaults in place (as about all I know about these settings is that 1)
I'm not using ipv6, and 2) anything that is needed for a router I don't
need, because I'm not a router :) ).

It rather sounds like Hans-Werner is onto something; often, when you
change your kernel configuration, you have to rebuild any external
modules against the new base, which you don't seem to have done.
Otherwise the external module thinks that functions are available that
it has to modprobe (because the functionality has changed from static to
module), and vice versa (if the functionality has changed from module to
static).

If I reconfigure my kernel to modify a sound module, then no, I don't
have to re-emerge the ati-drivers (because the kernel change is
irrelevant to the external module), but the same wouldn't be true if I
changed /dev/agpgart from static to a module.

In this case, you certainly are changing kernel options relevant to the
external modules, so those would have to be re-emerged against the new
kernel congiguration.

HTH,
Holly



-- 
gentoo-user@g.o mailing list