Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1395909 - firewalld not properly supporting samba & ftp from ver 0.4.4.1-1.fc24
Summary: firewalld not properly supporting samba & ftp from ver 0.4.4.1-1.fc24
Keywords:
Status: CLOSED DUPLICATE of bug 1394597
Alias: None
Product: Fedora
Classification: Fedora
Component: firewalld
Version: 24
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Thomas Woerner
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-11-16 22:55 UTC by dan
Modified: 2016-11-22 11:40 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-22 11:40:29 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description dan 2016-11-16 22:55:02 UTC 
Description of problem:

When using the firewalld GUI and the Fedora Workstation profile I am unable to successfully add samba to the policy.  Checking the smb box produces an error as follows:  INVALID_HELPER: nf_conntrack_netbios_ns not available in kernel.

However, as a workaround, I switched to the Fedora Server profile and was able to successfully add samba.
Comment 1 dan 2016-11-17 00:32:27 UTC 
On further check, the situation seems to be more serious.  Samba cannot be accessed from the network when firewalld is running, disabling firewalld allows access.  Will see if I can gather some additional info.
Comment 2 dan 2016-11-17 00:58:29 UTC 
Iptables output does not show that firewalld has inserted a rule for samba, ie ports 139/tcp, 445/tcp, etc.  Now I also see that trying to uncheck samba from the FedoraServer policy also triggers the error as above.

I next used firewalld to create an samba-workaround object with the proper ports, then reloaded firewalld.

Reload of firewalld also shows:

Nov 16 19:53:13 ears.private firewalld[3934]: WARNING: INVALID_HELPER: 'nf_conntrack_netbios_ns' not available in kernel

I next selected samba-workaround in the FedoraServer policy and it created the rules in iptables.

Issue worked around but obviously a serious problem for anyone running firewalld and samba.  


The issue began today after a dnf upgrade:

Nov 16 12:32:52 DEBUG ---> Package firewalld.noarch 0.4.3.3-1.fc24 will be upgraded
Nov 16 12:32:52 DEBUG ---> Package firewalld.noarch 0.4.4.1-1.fc24 will be an upgrade
Nov 16 12:32:52 DEBUG ---> Package firewalld-filesystem.noarch 0.4.3.3-1.fc24 will be upgraded
Nov 16 12:32:52 DEBUG ---> Package firewalld-filesystem.noarch 0.4.4.1-1.fc24 will be an upgrade
Comment 3 dan 2016-11-17 13:23:56 UTC 
ftp also affected with similar error, unable to load nf_conntrack_ftp, not in kernel.
Comment 4 dan 2016-11-18 04:41:05 UTC 
Modprobe of modules prior to starting firewalld does not help.
Comment 5 John 2016-11-20 05:36:21 UTC 
Added info:

A "systemctl status firewalld" results in:

Nov 17 11:21:55 bilbo systemd[1]: Starting firewalld - dynamic firewall daemon...
Nov 17 11:22:01 bilbo systemd[1]: Started firewalld - dynamic firewall daemon.
Nov 17 11:22:15 bilbo firewalld[724]: WARNING: INVALID_HELPER: 'nf_conntrack_ftp' not available in kernel
Nov 17 11:22:17 bilbo firewalld[724]: WARNING: INVALID_HELPER: 'nf_conntrack_netbios_ns' not available in kernel
Comment 6 Jeroen Huisman 2016-11-21 16:16:18 UTC 
Identical issue on Fedora 24 kernel 4.8.8-200.fc24.armv7hl

Upgraded:
Nov 21 10:21:22 DEBUG ---> Package firewall-config.noarch 0.4.3.3-1.fc24 will be upgraded
Nov 21 10:21:22 DEBUG ---> Package firewall-config.noarch 0.4.4.1-1.fc24 will be an upgrade
Nov 21 10:21:22 DEBUG ---> Package firewalld.noarch 0.4.3.3-1.fc24 will be upgraded
Nov 21 10:21:22 DEBUG ---> Package firewalld.noarch 0.4.4.1-1.fc24 will be an upgrade
Nov 21 10:21:22 DEBUG ---> Package firewalld-filesystem.noarch 0.4.3.3-1.fc24 will be upgraded
Nov 21 10:21:22 DEBUG ---> Package firewalld-filesystem.noarch 0.4.4.1-1.fc24 will be an upgrade
Comment 7 Igor Gnatenko 2016-11-22 11:40:29 UTC 

*** This bug has been marked as a duplicate of bug 1394597 ***
Note You need to log in before you can comment on or make changes to this bug.