Re: [PATCH] firewall: Ensure the xt_geoip module is always loaded

["Peter Müller" <peter.mueller@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 1466 bytes --]

Hello Michael,

thanks for your reply.

I have no idea, but am interested in the root cause of this as well. It only happens
while loading the firewall engine on first boot. On every subsequent boot, iptables
does not complain.

Thanks, and best regards,
Peter Müller

> Hello,
> 
> I would be great to know *why* this is happening.
> 
> iptables should automatically trigger loading the kernel module.
> 
> Did we just forget to run something like depmod -a?
> 
> -Michael
> 
>> On 30 Jan 2022, at 17:08, Peter Müller <peter.mueller(a)ipfire.org> wrote:
>>
>> For some reason, this module is not present after the very first boot of
>> an IPFire installation.
>>
>> Fixes: #12767
>>
>> Reported-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
>> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
>> ---
>> src/initscripts/system/firewall | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
>> index ebc8168ae..bfab6d538 100644
>> --- a/src/initscripts/system/firewall
>> +++ b/src/initscripts/system/firewall
>> @@ -39,6 +39,9 @@ iptables_init() {
>> 	iptables -P FORWARD DROP
>> 	iptables -P OUTPUT ACCEPT
>>
>> +	# Ensure the xt_geoip module is always loaded (#12767)
>> +	modprobe xt_geoip
>> +
>> 	# Enable TRACE logging to syslog
>> 	modprobe nf_log_ipv4
>> 	sysctl -q -w net.netfilter.nf_log.2=nf_log_ipv4
>> -- 
>> 2.31.1
>