#41 Firehol not active when using wireless

[zohn]

I'm using Firehol v1.256-3 on Ubuntu 8.10.
I use an external PCMCIA wireless card.

After booting up with the card plugged in, firehol is active according to the lock file in /var/lock.
However, in practice it is not active since it doesn't redirect http traffic to port 8080 as configured in firehol.conf.

After restarting firehol, the redirection works.

I'm attaching firehol.conf and /etc/default/firehol.

[zohn]

[zohn]

[zohn]

I just made a few more tests:
When firehol is working on the wifi connection (after restart), if I unplug and then replug the wifi card, it's not active on the wifi connection anymore. :(

[Costa Tsaousis]

Could you please post your firehol.conf and the output of 'ip addr show'?

If the wifi card is given a different device id every time it is inserted, you should match it in firehol with a '+'. For example, if the wifi card gets interface names like wifi0, wifi1, wifi2, etc, you should match it in firehol with wifi+ (the plus sign matches any id).

[Costa Tsaousis]

Sorry. I just saw your firehol.conf.

Could you please do this test:

1. Plug the card
2. run firehol
3. execute on a terminal: iptables -L -t nat >/tmp/nat1
4. Unplug the card
5. wait a few secs
6. plug the card again and wait a few secs
7. execute on a terminal: iptables -L -t nat >/tmp/nat2
8. execute on a terminal: diff /tmp/nat1 /tmp/nat2

If the last command resports differences between the two files, then when you plug your card ubuntu runs something that changes the running firewall.

[zohn]

output of 'ip addr show':

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN qlen 1000
link/ether 00:0b:cd🆎ef:d9 brd ff:ff:ff:ff:ff:ff
5: pan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
link/ether d2:4f:9b:58:06:0b brd ff:ff:ff:ff:ff:ff
8: wifi0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 199
link/ieee802.11 00:14:78:8f:8b:39 brd ff:ff:ff:ff:ff:ff
9: ath0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
link/ether 00:14:78:8f:8b:39 brd ff:ff:ff:ff:ff:ff
inet 192.168.2.100/24 brd 192.168.2.255 scope global ath0
inet6 fe80::214:78ff:fe8f:8b39/64 scope link
valid_lft forever preferred_lft forever
==================

/tmp/nat1:

Chain PREROUTING (policy ACCEPT)
target prot opt source destination
in_trproxy.1 tcp -- anywhere anywhere tcp spts:1024:65535 dpt:www

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
out_trproxy.1 tcp -- anywhere anywhere tcp spts:32768:61000 dpt:www

Chain in_trproxy.1 (1 references)
target prot opt source destination
REDIRECT tcp -- anywhere anywhere redir ports 8080

Chain out_trproxy.1 (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere OWNER UID match proxy
RETURN all -- anywhere anywhere OWNER UID match root
RETURN all -- anywhere localhost
REDIRECT tcp -- anywhere anywhere redir ports 8080
==================

/tmp/nat2:

Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
==================

diff /tmp/nat1 /tmp/nat2:

3d2
< in_trproxy.1 tcp -- anywhere anywhere tcp spts:1024:65535 dpt:www
10,21d8
< out_trproxy.1 tcp -- anywhere anywhere tcp spts:32768:61000 dpt:www
<
< Chain in_trproxy.1 (1 references)
< target prot opt source destination
< REDIRECT tcp -- anywhere anywhere redir ports 8080
<
< Chain out_trproxy.1 (1 references)
< target prot opt source destination
< RETURN all -- anywhere anywhere OWNER UID match proxy
< RETURN all -- anywhere anywhere OWNER UID match root
< RETURN all -- anywhere localhost
< REDIRECT tcp -- anywhere anywhere redir ports 8080
==================

So, yes ubuntu seems to clear iptables when I unplug the card.
When I plug in my card, I first have to run "sudo pccardctl insert 0" to make it work again.
But even after doing that, iptables remains like in /tmp/nat2.
When I restart Firehol after that, I get the same output as /tmp/nat1.

More specifically, Ubuntu seems to clear iptables as soon as the wifi connection is established.
I started Firehol while the card was unplugged.
After inserting the card and activating it, I checked 'iptables -L -t nat' continuously.
It became empty (i.e. back to default) once nm-applet displayed that the connection was established. :(

[zohn]

P.S: I'm currently using the following workaround:
I add '/etc/init.d/firehol restart' after the line 'do_start () {' in /etc/wpa_supplicant/ifupdown.sh
It gets run after a WPA connection is established (haven't tested it with other wireless connections or wired).