Правила Firewall - iptables

Технические вопросы по UTM 5.0
Закрыто
Student
Сообщения: 27
Зарегистрирован: Вт фев 08, 2005 10:17
Откуда: 127.0.0.1

Правила Firewall - iptables

Сообщение Student »

Здравствуйте. Фаервал iptables, OS Linux Fedora Core 8. Появилась такая проблема, если настроить правила фаервала и поставить галочки "Выполнять при добавлении абонента", "Выполнять при удалении абонента" то при удалении и добавлении абонента в iptables-е появляется правило которое указано при включении пользователя, а если не указывать выше перечисленное, а тоесть выполнять при включении и выключении абонента, то правила для фаервала не срабатывают и выдает следующие ошибки:

debug.log
?Debug : Apr 08 18:16:27 RPCConn[SSL]<init@192.168.2.4>: Call: 0x2003 (rpcf_change_intstat_for_user)
?Debug : Apr 08 18:16:27 RPCConn[SSL]<init@192.168.2.4>: Real Call: 0x2003 (rpcf_change_intstat_for_user)
?Debug : Apr 08 18:16:27 DBCtx: SQL query: UPDATE accounts SET int_status='0' WHERE id='14'
?Debug : Apr 08 18:16:27 BusLogic: BLM(38) pushed (comment: )
?Debug : Apr 08 18:16:27 UTM5 DBA: hw block for account 14
?Debug : Apr 08 18:16:27 RPCConn[SSL]<init@192.168.2.4>: Call 0x2003 (rpcf_change_intstat_for_user) finished...
?Debug : Apr 08 18:16:27 RPCConn[SSL]<init@192.168.2.4>: Stream cleared
?Debug : Apr 08 18:16:27 BusLogic: try to execute 38
?Debug : Apr 08 18:16:27 BusLogic: hw_block_handler with code 38
?Debug : Apr 08 18:16:27 BusLogic: hw_block_handler start bla_user_hw_unblock|bla_user_hw_block
?Debug : Apr 08 18:16:27 DBCtx: SQL SELECT query: SELECT is_for_all, uid, group_id, tariff_id, rule_on, rule_off, rule_block, router_id, and_logic, add_user, edit_user, del_user FROM firewall_rules WHERE is_deleted='0'
?Debug : Apr 08 18:16:27 UTM5 DBA: Rule on <-A FORWARD -p all -i eth1 -j ACCEPT> off <-A FORWARD -p all -i eth1 -j DROP>. User check <1> tariffs check <0> groups check <1>. And logic <disabled>
?Debug : Apr 08 18:16:27 UTM5 DBA: Rule added to final list!
?Debug : Apr 08 18:16:27 ModFWMan: Ready to execute 1 FW rules for UID 14. State:0...
?Debug : Apr 08 18:16:27 BusLogic: hw_block_handler end bla_user_hw_unblock|bla_user_hw_block
?Debug : Apr 08 18:16:27 BusLogic: finished unknown

?Debug : Apr 08 18:16:27 RPCConn[SSL]<init@192.168.2.4>: Call: 0x2011 (rpcf_get_users_count)
?Debug : Apr 08 18:16:27 RPCConn[SSL]<init@192.168.2.4>: Real Call: 0x2011 (rpcf_get_users_count)
?Debug : Apr 08 18:16:27 RPCConn[SSL]<init@192.168.2.4>: Call 0x2011 (rpcf_get_users_count) finished...
?Debug : Apr 08 18:16:27 RPCConn[SSL]<init@192.168.2.4>: Stream cleared
?Debug : Apr 08 18:16:27 RPCConn[SSL]<init@192.168.2.4>: Call: 0x2400 (rpcf_get_groups_list)
?Debug : Apr 08 18:16:27 RPCConn[SSL]<init@192.168.2.4>: Real Call: 0x2400 (rpcf_get_groups_list)
?Debug : Apr 08 18:16:28 DBA:Ctx: Looking for free context
?Debug : Apr 08 18:16:28 DBCtx: SQL SELECT query: SELECT id, group_name FROM groups
?Debug : Apr 08 18:16:28 DBA:Ctx: Pushing back free context
-Stats : Apr 08 18:16:28 DBA Groups: Stats: Uptime: 00:00:00. Events: 0; Errors: 0
?Debug : Apr 08 18:16:28 RPCConn[SSL]<init@192.168.2.4>: Call 0x2400 (rpcf_get_groups_list) finished...
?Debug : Apr 08 18:16:28 RPCConn[SSL]<init@192.168.2.4>: Stream cleared
?Debug : Apr 08 18:16:28 RPCConn[SSL]<init@192.168.2.4>: Call: 0x2001 (rpcf_get_users_list)
?Debug : Apr 08 18:16:28 RPCConn[SSL]<init@192.168.2.4>: Real Call: 0x2001 (rpcf_get_users_list)
?Debug : Apr 08 18:16:28 RPCConn[SSL]<init@192.168.2.4>: Call 0x2001 (rpcf_get_users_list) finished...
?Debug : Apr 08 18:16:28 RPCConn[SSL]<init@192.168.2.4>: Stream cleared
?Debug : Apr 08 18:16:53 FW@127.0.0.1: Ping reply received

rfw.log

?Debug : Apr 08 18:16:23 StreamFirewall: Got ping from core. Sending reply...
?Debug : Apr 08 18:16:53 StreamFirewall: Got ping from core. Sending reply...

Кто-нибудь сталкивался с подобной проблемой? Если да то подскажите пожалуйста решение, уже все что можно прогуглено и перепробовано. Спасибо.

Student
Сообщения: 27
Зарегистрирован: Вт фев 08, 2005 10:17
Откуда: 127.0.0.1

Сообщение Student »

а вот что пишет при добавлении и удалении юзверя

debug.log

?Debug : Apr 08 21:39:08 RPCConn[SSL]<init@192.168.2.4>: Call: 0x0060 (get-new-secret)
?Debug : Apr 08 21:39:08 RPCConn[SSL]<init@192.168.2.4>: Real Call: 0x0060 (get-new-secret)
?Debug : Apr 08 21:39:08 RPCConn[SSL]<init@192.168.2.4>: Call 0x0060 (get-new-secret) finished...
?Debug : Apr 08 21:39:08 RPCConn[SSL]<init@192.168.2.4>: Stream cleared
?Debug : Apr 08 21:39:08 RPCConn[SSL]<init@192.168.2.4>: Call: 0x2035 (rpcf_get_sys_settings)
?Debug : Apr 08 21:39:08 RPCConn[SSL]<init@192.168.2.4>: Real Call: 0x2035 (rpcf_get_sys_settings)
?Debug : Apr 08 21:39:08 RPCConn[SSL]<init@192.168.2.4>: Call 0x2035 (rpcf_get_sys_settings) finished...
?Debug : Apr 08 21:39:08 RPCConn[SSL]<init@192.168.2.4>: Stream cleared
?Debug : Apr 08 21:39:08 RPCConn[SSL]<init@192.168.2.4>: Call: 0x6002 (__rpcs_get_banks)
?Debug : Apr 08 21:39:08 RPCConn[SSL]<init@192.168.2.4>: Real Call: 0x6002 (__rpcs_get_banks)
?Debug : Apr 08 21:39:08 DBCtx: SQL SELECT query: SELECT id,bic,name,city,kschet FROM banks ORDER BY id
?Debug : Apr 08 21:39:08 RPCConn[SSL]<init@192.168.2.4>: Call 0x6002 (__rpcs_get_banks) finished...
?Debug : Apr 08 21:39:08 RPCConn[SSL]<init@192.168.2.4>: Stream cleared
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Call: 0x2005 (rpcf_add_user)
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Real Call: 0x2005 (rpcf_add_user)
?Debug : Apr 08 21:39:10 UTM5 DBA: DBAccess instance created
?Debug : Apr 08 21:39:10 DBA:Ctx: Looking for free context
Info : Apr 08 21:39:10 UTMCtx: Encrypt: No ctx found
?Debug : Apr 08 21:39:10 UTMCtx: Unencrypted message passed!
?Debug : Apr 08 21:39:10 DBCtx: SQL query: INSERT INTO users(login,password,basic_account,is_blocked,discount_period_id,create_date,last_change_date,who_create,who_change,is_juridical,full_name,juridical_address,actual_address,flat_number,entrance,floor,district,building,passport,work_telephone,home_telephone,mobile_telephone,web_page,icq_number,tax_number,kpp_number,email,bank_id,bank_account,comments,house_id,is_send_invoice,advance_payment,personal_manager) VALUES('111','8646a0','0','0','0','1207654750','1207654750','-1','-1','0','','','','','','','','','','','','','','','','','','0','','','0','0','0','')
?Debug : Apr 08 21:39:10 DBCtx: SQL SELECT query: SELECT value FROM utm5_settings WHERE variable='card_user_prefix'
?Debug : Apr 08 21:39:10 DBCtx: SQL SELECT query: SELECT is_for_all, uid, group_id, tariff_id, rule_on, rule_off, rule_block, router_id, and_logic, add_user, edit_user, del_user FROM firewall_rules WHERE is_deleted='0' AND (add_user!=0 OR edit_user!=0 OR del_user!=0)
?Debug : Apr 08 21:39:10 UTM5 DBA: Rule on <-A FORWARD -s UIP/UBITS -j ACCEPT> off <-D FORWARD -s UIP/UBITS -j ACCEPT>. User check <1> tariffs check <0> groups check <-1>. And logic <disabled>
?Debug : Apr 08 21:39:10 UTM5 DBA: Rule added to final list!
?Debug : Apr 08 21:39:10 ModFWMan: Ready to execute 1 FW rules for UID 22. Action:1
?Debug : Apr 08 21:39:10 ModFWMan: FW rule parse. Setting RULE_ID to <5022> uid <22>

?Debug : Apr 08 21:39:10 DBA:Ctx: Looking for free context
?Debug : Apr 08 21:39:10 DBCtx: SQL SELECT query: SELECT login, password, basic_account, is_blocked, create_date, last_change_date, who_create, who_change, is_juridical, full_name, juridical_address, actual_address, work_telephone, home_telephone, mobile_telephone, web_page, icq_number, tax_number, kpp_number, bank_id, bank_account, comments, discount_period_id, email, house_id, flat_number, entrance, floor, district, building, passport, personal_manager, connect_date, is_send_invoice, advance_payment FROM users WHERE id='22' AND is_deleted=0
?Debug : Apr 08 21:39:10 DBCtx: SQL SELECT query: SELECT group_id FROM users_groups_link WHERE user_id='22'
?Debug : Apr 08 21:39:10 DBCtx: SQL SELECT query: SELECT paramid, value FROM user_additional_params WHERE userid='22'
?Debug : Apr 08 21:39:10 DBCtx: SQL SELECT query: SELECT remote_switch_id, port_number FROM users WHERE id='22'
?Debug : Apr 08 21:39:10 ModFWMan: FW rule parse. Substituting ACCOUNT_ID with value <0> original value <0>
?Debug : Apr 08 21:39:10 ModFWMan: FW rule parse. Substituting UBITS with value <32> original value <-1>
?Debug : Apr 08 21:39:10 ModFWMan: FW rule parse. Substituting EMAIL with value <> (obtained from user data)
?Debug : Apr 08 21:39:10 ModFWMan: FW rule parse. Substituting TRAFFIC_LIMIT with value <0>
?Debug : Apr 08 21:39:10 DBA:Ctx: Pushing back free context
-Stats : Apr 08 21:39:10 DBA Groups: Stats: Uptime: 00:00:00. Events: 0; Errors: 0
?Debug : Apr 08 21:39:10 ModFWMan: Exec [-A FORWARD -s 0.0.0.0/32 -j ACCEPT] on 3
?Debug : Apr 08 21:39:10 FW@127.0.0.1: Sending [-A FORWARD -s 0.0.0.0/32 -j ACCEPT]

?Debug : Apr 08 21:39:10 DBCtx: SQL query: INSERT INTO user_log(user_id,date,who,what,comment) VALUES('22', '1207654750', '-1', 'user_add', '111')
?Debug : Apr 08 21:39:10 DBA:Ctx: Pushing back free context
-Stats : Apr 08 21:39:10 UTM5 DBA: Stats: Uptime: 00:00:00. Events: 0; Errors: 0
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Call 0x2005 (rpcf_add_user) finished...
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Stream cleared
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Call: 0x2031 (rpcf_add_account)
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Real Call: 0x2031 (rpcf_add_account)
?Debug : Apr 08 21:39:10 DBCtx: SQL query: INSERT INTO accounts(balance,account_name,credit,flags,discount_period_id,dealer_account_id,comission_coef,default_comission_value,is_dealer,int_status,block_recalc_abon,block_recalc_prepaid) VALUES('0','auto create account','0','3','0','0','0','0','0','0','0','0')
?Debug : Apr 08 21:39:10 DBCtx: SQL query: INSERT into users_accounts(uid,account_id) VALUES(22,22)
?Debug : Apr 08 21:39:10 DBCtx: SQL query: UPDATE users SET basic_account=22 WHERE id=22
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Call 0x2031 (rpcf_add_account) finished...
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Stream cleared
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Call: 0x2011 (rpcf_get_users_count)
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Real Call: 0x2011 (rpcf_get_users_count)
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Call 0x2011 (rpcf_get_users_count) finished...
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Stream cleared
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Call: 0x2400 (rpcf_get_groups_list)
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Real Call: 0x2400 (rpcf_get_groups_list)
?Debug : Apr 08 21:39:10 DBA:Ctx: Looking for free context
?Debug : Apr 08 21:39:10 DBCtx: SQL SELECT query: SELECT id, group_name FROM groups
?Debug : Apr 08 21:39:10 DBA:Ctx: Pushing back free context
-Stats : Apr 08 21:39:10 DBA Groups: Stats: Uptime: 00:00:00. Events: 0; Errors: 0
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Call 0x2400 (rpcf_get_groups_list) finished...
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Stream cleared
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Call: 0x2001 (rpcf_get_users_list)
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Real Call: 0x2001 (rpcf_get_users_list)
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Call 0x2001 (rpcf_get_users_list) finished...
?Debug : Apr 08 21:39:10 RPCConn[SSL]<init@192.168.2.4>: Stream cleared

rfw.log

?Debug : Apr 08 21:39:10 StreamFirewall: Got 'exec' command...
?Debug : Apr 08 21:39:10 FWCntl: Executing command </sbin/iptables>
?Debug : Apr 08 21:39:10 FWCntl: dont_fork disabled. Don't wait child process ...
?Debug : Apr 08 21:39:10 FWCntl: Executing FW rule: -A FORWARD -s 0.0.0.0/32 -j ACCEPT is done.

Student
Сообщения: 27
Зарегистрирован: Вт фев 08, 2005 10:17
Откуда: 127.0.0.1

Сообщение Student »

:D Проблема решена правильным заполнением тарифа, переадку пользователя на него и прописанием ему IP адреса. Всем спасибо.

Закрыто