Firewalld not starting on boot - set to start On Boot in YaST Services Manager

English Network/Internet
#1

Hi all,

I have been trying to figure out why firewalld doesn’t start at boot and the only thing I can find about it is in the SuSEFirewall2 era. I do not know if this has started since I upgraded from 15.3 to 15.4 or not. But now when I think about it I had problems sharing samba and gave up the idea.

The firewalld service is set to Start ‘On Boot’ in YaST Services Manager though

sudo systemctl status firewalld
○ firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: disabled)
     Active: inactive (dead)
       Docs: man:firewalld(1)

Not unless I enforce the service to start manually it won’t start at boot.

Wondering around the interweb searching for answers I came across if it could have something to do with libvirt, so this is my libvirt status, just in case it is the culprit:

sudo systemctl status libvirtd
● libvirtd.service - Virtualization daemon
     Loaded: loaded (/usr/lib/systemd/system/libvirtd.service; enabled; vendor preset: disabled)
     Active: active (running) since Fri 2023-03-10 07:15:39 EST; 29min ago
TriggeredBy: ● libvirtd-admin.socket
             ● libvirtd-ro.socket
             ● libvirtd.socket
       Docs: man:libvirtd(8)
             https://libvirt.org
   Main PID: 17137 (libvirtd)
      Tasks: 23 (limit: 32768)
     CGroup: /system.slice/libvirtd.service
             ├─  7837 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper
             ├─  7838 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper
             └─ 17137 /usr/sbin/libvirtd --timeout 120

Mar 10 07:15:39 SimorghSUSE.local systemd[1]: Starting Virtualization daemon...
Mar 10 07:15:39 SimorghSUSE.local libvirtd[17137]: libvirt version: 8.0.0
Mar 10 07:15:39 SimorghSUSE.local libvirtd[17137]: hostname: SimorghSUSE.local
Mar 10 07:15:39 SimorghSUSE.local libvirtd[17137]: Failed to initialize libnetcontrol.  Management of interface devices is disabled
Mar 10 07:15:39 SimorghSUSE.local systemd[1]: Started Virtualization daemon.
Mar 10 07:15:39 SimorghSUSE.local dnsmasq[7837]: read /etc/hosts - 7 addresses
Mar 10 07:15:39 SimorghSUSE.local dnsmasq[7837]: read /var/lib/libvirt/dnsmasq/default.addnhosts - 0 addresses
Mar 10 07:15:39 SimorghSUSE.local dnsmasq-dhcp[7837]: read /var/lib/libvirt/dnsmasq/default.hostsfile

After manual start:

sudo systemctl start firewalld.service 

sudo systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: disabled)
     Active: active (running) since Fri 2023-03-10 07:56:32 EST; 8s ago
       Docs: man:firewalld(1)
   Main PID: 3906 (firewalld)
      Tasks: 2 (limit: 4915)
     CGroup: /system.slice/firewalld.service
             └─ 3906 /usr/bin/python3 /usr/sbin/firewalld --nofork --nopid

Mar 10 07:56:32 SimorghSUSE.local systemd[1]: Starting firewalld - dynamic firewall daemon...
Mar 10 07:56:32 SimorghSUSE.local systemd[1]: Started firewalld - dynamic firewall daemon.

Would appreciate your guidance.

Thank you in advance.

#2

Is SuSEfirewall2.service active?

#3

Sorry not clarifying it @arvidjaar
My system is not from prior to 15 era where I believe SuSEfirewall2 was active.
I do not have SuSEfirewall2.service on my system.

#4

Then reboot and provide full output of journalctl -b --no-pager as root. Upload to https://susepaste.org/

#5

The output of journalctl -b --no-pager .

#6

A web-browser search didn’t reveal anything – I’ve downloaded your raw input to susepaste and the following results can be seen:

 > grep -i 'fire' 4bbc0fe1eaca1bb0837669c974c96a1b.txt
 > 
 > grep -B 4 -A 4 'Reached target Host and Network Name Lookups' 4bbc0fe1eaca1bb0837669c974c96a1b.txt
Mar 10 08:36:26 SimorghSUSE systemd[1]: Finished Save/Restore Sound Card State.
Mar 10 08:36:26 SimorghSUSE systemd[1]: issue-generator.service: Deactivated successfully.
Mar 10 08:36:26 SimorghSUSE systemd[1]: Finished Generate issue file for login session.
Mar 10 08:36:26 SimorghSUSE systemd[1]: Started Name Service Cache Daemon.
Mar 10 08:36:26 SimorghSUSE systemd[1]: Reached target Host and Network Name Lookups.
Mar 10 08:36:26 SimorghSUSE systemd[1]: Reached target User and Group Name Lookups.
Mar 10 08:36:26 SimorghSUSE systemd[1]: Condition check resulted in Manage Sound Card State (restore and store) being skipped.
Mar 10 08:36:26 SimorghSUSE systemd[1]: Starting Load extra kernel modules for sound stuff...
Mar 10 08:36:26 SimorghSUSE systemd[1]: Starting User Login Management...
 >

AFAICS, the network is being setup OK but, the Firewall daemon isn’t being started.
Some suggestions for where to check:

 > systemctl list-unit-files | grep -iE 'UNIT FILE    |fire'
UNIT FILE                                                                 STATE           VENDOR PRESET
dbus-org.fedoraproject.FirewallD1.service                                 alias           -
firewalld.service                                                         enabled         disabled
 > 

 # systemctl status firewalld.service 
● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: disabled)
     Active: active (running) since Fri 2023-03-10 09:10:05 CET; 7h ago
       Docs: man:firewalld(1)
   Main PID: 981 (firewalld)
      Tasks: 2 (limit: 4915)
     CGroup: /system.slice/firewalld.service
             └─ 981 /usr/bin/python3 /usr/sbin/firewalld --nofork --nopid

Mär 10 09:10:04 xxx systemd[1]: Starting firewalld - dynamic firewall daemon...
Mär 10 09:10:05 xxx systemd[1]: Started firewalld - dynamic firewall daemon.
 # 
 # journalctl -b 0 --no-hostname --output=short-monotonic | grep -i 'firewall' -B 2 -A 2
[   10.038299] systemd[1]: Started D-Bus System Message Bus.
[   10.040925] systemd[1]: Started Detect if the system suffers from bsc#1089761.
[   10.043164] systemd[1]: Starting firewalld - dynamic firewall daemon...
[   10.047073] systemd[1]: Started irqbalance daemon.
[   10.048548] systemd[1]: Starting Generate issue file for login session...
--
[   10.585403] dbus-daemon[979]: [system] Successfully activated service 'org.freedesktop.ColorManager'
[   10.585636] systemd[1]: Started Manage, Install and Generate Color Profiles.
[   10.693175] systemd[1]: Started firewalld - dynamic firewall daemon.
[   10.693469] systemd[1]: Reached target Preparation for Network.
[   10.696243] systemd[1]: Starting wicked AutoIPv4 supplicant service...
--
[   10.793017] kernel: No iBFT detected.
[   11.010516] avahi-daemon[977]: Server startup complete. Host name is xxx.local. Local service cookie is 2738715431.
[   11.453206] dbus-daemon[979]: [system] Activating via systemd: service name='org.freedesktop.PolicyKit1' unit='polkit.service' requested by ':1.5' (uid=0 pid=981 comm="/usr/bin/python3 /usr/sbin/firewalld --nofork --no")
[   11.456872] systemd[1]: Starting Authorization Manager...
[   11.487265] polkitd[1203]: Started polkitd version 0.116
 # 
 # firewall-cmd --state
running
 # 
 # firewall-cmd --check-config
success
 #
 # firewall-cmd --get-active-zones
docker
  interfaces: docker0
trusted
  interfaces: eth0
 # 
 # firewall-cmd --get-policies
allow-host-ipv6
 #
1 Like
#7

This is what I get:

sudo systemctl list-unit-files | grep -iE 'UNIT FILE    |fire'
UNIT FILE                                                                 STATE           VENDOR PRESET
dbus-org.fedoraproject.FirewallD1.service                                 alias           -
firewalld.service                                                         enabled         disabled

And

sudo systemctl status firewalld.service
○ firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: disabled)
     Active: inactive (dead)
       Docs: man:firewalld(1)

It is enabled, and it is set to Start On Boot in YaST Services Manager, but it won’t start on boot. I have to manually start it, so for example KDE Connect won’t connect unless I have the firewalld started manually.

#8

There is no trace of firewalld. Run

ls -l /etc/systemd/system/multi-user.target.wants/firewalld.service
systemctl disable firewalld.service
systemctl enable firewalld.service
ls -l /etc/systemd/system/multi-user.target.wants/firewalld.service
1 Like
#9

What astute observation …

#10 
ls -l /etc/systemd/system/multi-user.target.wants/firewalld.service
lrwxrwxrwx 1 root root 41 Feb 28  2021 /etc/systemd/system/multi-user.target.wants/firewalld.service -> /usr/lib/systemd/system/firewalld.service

sudo systemctl disable firewalld.service
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.

sudo systemctl enable firewalld.service
Created symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service → /usr/lib/systemd/system/firewalld.service.
Created symlink /etc/systemd/system/multi-user.target.wants/firewalld.service → /usr/lib/systemd/system/firewalld.service.

ls -l /etc/systemd/system/multi-user.target.wants/firewalld.service
lrwxrwxrwx 1 root root 41 Mar 10 11:44 /etc/systemd/system/multi-user.target.wants/firewalld.service -> /usr/lib/systemd/system/firewalld.service

Should I reboot the system now to see if it starts or not yet?

Thanks.

#11

Reboot, but add kernel parameters

systemd.log_level=debug printk.devkmsg=on

And post journalctl -b --no-pager output again. It was already OK (there was some chance that the correct link was missing).

#13

Where do I add kernel parameters? Sorry for asking, don’t want to mess up.

#14

In grub menu after reboot press e on the menu entry, then you are in an editor; move cursor to the line starting with linux or linuxefi and add parameters there. You can add them anywhere on the line, just separated by spaces.

Or you could use YaST Bootloader module but it adds them permanently, you probably do not want to run with debug logging.

#15

So it should be OK to have ‘systemd.log_level=debug printk.devkmsg=on’ in YaST Bootloader module permanently?

#16

So maybe I should do a grub menu edit and see the outcome first?

#17

Well, you just get more verbose logging in journal. But you can always remove them after troubleshooting is done.

#18

Will do. Will be right back.

#19

It is more than 2MB. susepaste doesn’t allow me. Even pastebin is complaining.
It is 6 MB.

#20

I put it as a .txt file on my Cloud backup (Tresorit). It can be viewed directly in the browser:

journalctl.txt

Thanks

#21

Another thing I noticed just now when doing the following:

sudo systemctl status firewalld.service 
[sudo] password for root: 
○ firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: disabled)
     Active: inactive (dead)
       Docs: man:firewalld(1)

Mar 10 12:05:27 SimorghSUSE systemd[1]: firewalld.service: Looking at job firewalld.service/start conflicted_by=no
Mar 10 12:05:27 SimorghSUSE systemd[1]: firewalld.service: Looking at job firewalld.service/stop conflicted_by=yes
Mar 10 12:05:27 SimorghSUSE systemd[1]: firewalld.service: Fixing conflicting jobs firewalld.service/start,firewalld.service/stop by deleting job firewalld.service/start
Mar 10 12:05:28 SimorghSUSE systemd[1]: firewalld.service: Watching D-Bus name 'org.fedoraproject.FirewallD1'.
Mar 10 12:05:28 SimorghSUSE systemd[1]: firewalld.service: D-Bus name org.fedoraproject.FirewallD1 now not owned by anyone.

It says there is a conflict. This wasn’t there before.

Manually starting firewalld:

sudo systemctl start firewalld.service 
sudo systemctl status firewalld.service 
● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: disabled)
     Active: active (running) since Fri 2023-03-10 12:37:39 EST; 1s ago
       Docs: man:firewalld(1)
   Main PID: 8769 (firewalld)
      Tasks: 2 (limit: 4915)
     CGroup: /system.slice/firewalld.service
             └─ 8769 /usr/bin/python3 /usr/sbin/firewalld --nofork --nopid

Mar 10 12:37:39 SimorghSUSE.local systemd[1]: firewalld.service: Changed dead -> start
Mar 10 12:37:39 SimorghSUSE.local systemd[1]: Starting firewalld - dynamic firewall daemon...
Mar 10 12:37:39 SimorghSUSE.local systemd[8769]: firewalld.service: Executing: /usr/sbin/firewalld --nofork --nopid
Mar 10 12:37:39 SimorghSUSE.local systemd[1]: firewalld.service: D-Bus name org.fedoraproject.FirewallD1 now owned by :1.87
Mar 10 12:37:39 SimorghSUSE.local systemd[1]: firewalld.service: Changed start -> running
Mar 10 12:37:39 SimorghSUSE.local systemd[1]: firewalld.service: Job 3442 firewalld.service/start finished, result=done
Mar 10 12:37:39 SimorghSUSE.local systemd[1]: Started firewalld - dynamic firewall daemon.
Mar 10 12:37:39 SimorghSUSE.local systemd[1]: firewalld.service: Failed to send unit change signal for firewalld.service: Connection reset by peer