Skip to main content ↑ ↓
Topic solved
This topic has been marked as solved and requires no further attention.
Topic: [SOLVED] How to disable packet forwarding. Sysctl does not load config automatically. (Read 600 times) previous topic - next topic
0 Members and 1 Guest are viewing this topic.

[SOLVED] How to disable packet forwarding. Sysctl does not load config automatically.

Hello, I try to diasble packet forwarding using .conf file located in the /etc/sysctl.d/*.conf file:
net.ipv4.ip_forward = 0
net.ipv4.conf.all.forwarding = 0
net.ipv6.conf.all.forwarding = 0
but for some reason it does not load it (sysctl -a | grep forward) and I have to do it manually after every reboot. Any ideas why and how to fix it?

Re: How to disable packet forwarding. Sysctl does not load config automatically.

Reply #1 –
Is the sysctl service enabled ?

Re: How to disable packet forwarding. Sysctl does not load config automatically.

Reply #2 –
Yeah, I have enabled it and it is running. I have read that sysctl have this bug but I have no idea whether it is connected to my problem.
Code: [Select]
#!/usr/bin/openrc-run
# Copyright (c) 2007-2015 The OpenRC Authors.
# See the Authors file at the top-level directory of this distribution and
# https://github.com/OpenRC/openrc/blob/HEAD/AUTHORS
#
# This file is part of OpenRC. It is subject to the license terms in
# the LICENSE file found in the top-level directory of this
# distribution and at https://github.com/OpenRC/openrc/blob/HEAD/LICENSE
# This file may not be copied, modified, propagated, or distributed
# except according to the terms contained in the LICENSE file.

depend()
{
        after clock
        #after net
        before bootmisc logger
        keyword -prefix -systemd-nspawn -vserver
}

BSD_sysctl()
{
        [ -e /etc/sysctl.conf ] || return 0
        local retval=0 var= comments= conf=
        eindent
        for conf in /etc/sysctl.conf /etc/sysctl.d/*.conf; do
                if [ -r "$conf" ]; then
                        vebegin "applying $conf"
                        while read var comments; do
                                case "$var" in
                                ""|"#"*) continue;;
                                esac
                                sysctl -w "$var" >/dev/null || retval=1
                        done < "$conf"
                        veend $retval
                fi
        done
        eoutdent
        return $retval
}

Linux_sysctl()
{
        local quiet
        yesno $rc_verbose || quiet=-q

        sysctl ${quiet} --system
}

start()
{
        local rc=0

        ebegin "Configuring kernel parameters"
        case "$RC_UNAME" in
        *BSD|GNU) BSD_sysctl; rc=$? ;;
        Linux) Linux_sysctl; rc=$? ;;
        esac
        eend $rc "Unable to configure some kernel parameters"
}

Re: How to disable packet forwarding. Sysctl does not load config automatically.

Reply #3 –
In /etc/rc.conf set.
Quote
rc_logger="YES"
rc_verbose="YES"
Reboot and have a look of the last instance (most recent) output in /var/log/rc.log after "* Configuring kernel parameters ..." and post it (up to where it's obviously the the next service).

Re: How to disable packet forwarding. Sysctl does not load config automatically.

Reply #4 –
Code: [Select]
sysctl               | * Configuring kernel parameters ...
sysctl               |* Applying /usr/lib/sysctl.d/10-artix.conf ...
 [ ok ]
sysctl               |* Applying /etc/sysctl.d/30-ipforward.conf ...
 [ ok ]
sysctl               |* Applying /usr/lib/sysctl.d/50-default.conf ...
sysctl               |* Applying /usr/lib/sysctl.d/60-libvirtd.conf ...
sysctl               |* Applying /usr/lib/sysctl.d/60-qemu-postcopy-migration.conf ...
sysctl               |* Applying /etc/sysctl.d/99_magic_sysrq.conf ...
sysctl               |fs.inotify.max_user_instances = 1024
sysctl               |fs.inotify.max_user_watches = 524288
sysctl               |vm.max_map_count = 1048576
sysctl               |net.ipv4.ip_forward = 0
sysctl               |net.ipv4.conf.all.forwarding = 0
sysctl               |net.ipv4.conf.all.rp_filter = 1
sysctl               |net.ipv4.conf.default.accept_source_route = 0
sysctl               |net.ipv4.conf.all.accept_source_route = 0
sysctl               |net.ipv4.conf.all.promote_secondaries = 1
sysctl               |net.ipv4.ping_group_range = 0 2147483647
sysctl               |net.core.default_qdisc = fq_codel
sysctl               |fs.protected_hardlinks = 1
sysctl               |fs.protected_symlinks = 1
sysctl               |fs.protected_regular = 1
sysctl               |fs.protected_fifos = 1
sysctl               |fs.aio-max-nr = 1048576
sysctl               |vm.unprivileged_userfaultfd = 1
sysctl               |kernel.sysrq = 1
 [ ok ]
I have disabled IPv6 so there is no entry in the log.

Re: How to disable packet forwarding. Sysctl does not load config automatically.

Reply #5 –
Quote
Any ideas why and how to fix it?
Something else is changing it and to fix it you need to work out what / why. That's my idea. Or possibly you are mistaken in your belief ?
You said before you run
Code: [Select]
sysctl -a | grep forward
but didn't show the output.

With "rc_verbose="YES" /etc/init.d/sysctl is running this command
Code: [Select]
sysctl --system
try that with sudo or as root and you'll get the same output as you have in rc.log.

Re: How to disable packet forwarding. Sysctl does not load config automatically.

Reply #6 –
Quote
Something else is changing it and to fix it you need to work out what / why. That's my idea. Or possibly you are mistaken in your belief ?
No, I am not mistaken. You are probably right that something could change settings. However, I have no idea how to check it.
Log after logging in.
sysctl -a | grep forward
Code: [Select]
sysctl: permission denied on key 'kernel.cad_pid'
sysctl: permission denied on key 'kernel.usermodehelper.bset'
sysctl: permission denied on key 'kernel.usermodehelper.inheritable'
sysctl: permission denied on key 'net.core.bpf_jit_harden'
sysctl: permission denied on key 'net.core.bpf_jit_kallsyms'
sysctl: permission denied on key 'net.core.bpf_jit_limit'
net.ipv4.conf.all.bc_forwarding = 0
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.default.bc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.dummy0.bc_forwarding = 0
net.ipv4.conf.dummy0.forwarding = 1
net.ipv4.conf.dummy0.mc_forwarding = 0
net.ipv4.conf.eth0.bc_forwarding = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.eth1.bc_forwarding = 0
net.ipv4.conf.eth1.forwarding = 1
net.ipv4.conf.eth1.mc_forwarding = 0
net.ipv4.conf.lo.bc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.pvpnksintrf1.bc_forwarding = 0
net.ipv4.conf.pvpnksintrf1.forwarding = 1
net.ipv4.conf.pvpnksintrf1.mc_forwarding = 0
net.ipv4.conf.tun0.bc_forwarding = 0
net.ipv4.conf.tun0.forwarding = 1
net.ipv4.conf.tun0.mc_forwarding = 0
net.ipv4.conf.virbr0.bc_forwarding = 0
net.ipv4.conf.virbr0.forwarding = 1
net.ipv4.conf.virbr0.mc_forwarding = 0
net.ipv4.conf.wlan0.bc_forwarding = 0
net.ipv4.conf.wlan0.forwarding = 1
net.ipv4.conf.wlan0.mc_forwarding = 0
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0
sysctl: permission denied on key 'net.ipv4.tcp_fastopen_key'
sysctl: permission denied on key 'vm.mmap_rnd_bits'
sysctl: permission denied on key 'vm.mmap_rnd_compat_bits'
Log after running
sysctl -e --system
Code: [Select]
* Applying /usr/lib/sysctl.d/10-artix.conf ...
* Applying /etc/sysctl.d/30-ipforward.conf ...
* Applying /usr/lib/sysctl.d/50-default.conf ...
* Applying /usr/lib/sysctl.d/60-libvirtd.conf ...
* Applying /usr/lib/sysctl.d/60-qemu-postcopy-migration.conf ...
* Applying /etc/sysctl.d/99_magic_sysrq.conf ...
fs.inotify.max_user_instances = 1024
fs.inotify.max_user_watches = 524288
vm.max_map_count = 1048576
net.ipv4.ip_forward = 0
net.ipv4.conf.all.forwarding = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.promote_secondaries = 1
net.ipv4.ping_group_range = 0 2147483647
net.core.default_qdisc = fq_codel
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.protected_regular = 1
fs.protected_fifos = 1
fs.aio-max-nr = 1048576
vm.unprivileged_userfaultfd = 1
kernel.sysrq = 1
sysctl -a | grep forward
Code: [Select]
sysctl: permission denied on key 'kernel.cad_pid'
sysctl: permission denied on key 'kernel.usermodehelper.bset'
sysctl: permission denied on key 'kernel.usermodehelper.inheritable'
sysctl: permission denied on key 'net.core.bpf_jit_harden'
sysctl: permission denied on key 'net.core.bpf_jit_kallsyms'
sysctl: permission denied on key 'net.core.bpf_jit_limit'
net.ipv4.conf.all.bc_forwarding = 0
net.ipv4.conf.all.forwarding = 0
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.default.bc_forwarding = 0
net.ipv4.conf.default.forwarding = 0
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.dummy0.bc_forwarding = 0
net.ipv4.conf.dummy0.forwarding = 0
net.ipv4.conf.dummy0.mc_forwarding = 0
net.ipv4.conf.eth0.bc_forwarding = 0
net.ipv4.conf.eth0.forwarding = 0
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.eth1.bc_forwarding = 0
net.ipv4.conf.eth1.forwarding = 0
net.ipv4.conf.eth1.mc_forwarding = 0
net.ipv4.conf.lo.bc_forwarding = 0
net.ipv4.conf.lo.forwarding = 0
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.pvpnksintrf1.bc_forwarding = 0
net.ipv4.conf.pvpnksintrf1.forwarding = 0
net.ipv4.conf.pvpnksintrf1.mc_forwarding = 0
net.ipv4.conf.tun0.bc_forwarding = 0
net.ipv4.conf.tun0.forwarding = 0
net.ipv4.conf.tun0.mc_forwarding = 0
net.ipv4.conf.virbr0.bc_forwarding = 0
net.ipv4.conf.virbr0.forwarding = 0
net.ipv4.conf.virbr0.mc_forwarding = 0
net.ipv4.conf.wlan0.bc_forwarding = 0
net.ipv4.conf.wlan0.forwarding = 0
net.ipv4.conf.wlan0.mc_forwarding = 0
net.ipv4.ip_forward = 0
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0
sysctl: permission denied on key 'net.ipv4.tcp_fastopen_key'
sysctl: permission denied on key 'vm.mmap_rnd_bits'
sysctl: permission denied on key 'vm.mmap_rnd_compat_bits'
 

Re: How to disable packet forwarding. Sysctl does not load config automatically.

Reply #7 –
If you use any form of network manager that would be a likely candidate for what else could be changing it after sysctl. Other than that idk ?

Re: How to disable packet forwarding. Sysctl does not load config automatically.

Reply #8 –
I use NetworkManager and Portmaster. I use also qemu/libvirt.


EDIT:
I found the culprit - libvirt services were setting their own configuration.
 
Artix forum uses a single cookie to remember youOK