Issue with Shorewall...Masq config not persistent

Debian 12.5 REQUIRED
When I make changes to Masq and click on check firewall… the changes “disappear”. This is what I get:
Checking using Shorewall 5.2.8…
Converting /etc/shorewall/masq…
Converted /etc/shorewall/masq to /etc/shorewall/snat
/etc/shorewall/masq renamed /etc/shorewall/masq.bak

So “behind the scenes” my config is getting “deleted”.

When I go to the Shorewall site I see that some changes have been recently made in how masq/snat is configured, so I’m wondering whether I’m doing something wrong or whether I need to use an older version of Shorewall, such as 4.6 or 5.0 to be compatible with Webmin… Thanks.

Its more to do with you OS rather then Webmin unless your talking about a Webmin module.

Should have added the following link:

where you can see:

  1. Support for the deprecated ‘masq’ file has been deleted. Any
    existing ‘masq’ file will automatically be converted to the
    equivalent ‘snat’ file.

This seems to be what I’m seeing in the earlier post. So it seems that maybe Webmin has not adjusted to the latest version. It also appears that is the latest that might work. Per:

I was just hope’n someone else might have some insight into this issue. Thanks.

BTW, the latest version of shorewall installed on Debian by apt install shorewall is 5.2.8, which is the version that makes the file swap above.

I think I’ve found the source of my confusion. After I got the message that the files had been swapped, I clicked on the webmin icon for Static NAT (nat) which I assumed would open the /etc/shorewall/snat (even though now, I see I should have got the parenthetical clue) and the changes were not there (because I was actually viewing the /etc/shorewall/nat file). So I now see how I can edit the snat file using Masq but that just replaces the snat file with whatever I entered into the Masq input form, it does not provide a way for me to do small edits. I’m thinking that it would be handy to have the Masq input form reconfigured as an snat input form.

I have not yet tested the system to see if it is actually performing NAT on the interface. That is the problem I was working on when I stumbled onto this issue.

Am I thinking correctly?

Work around in case anyone has the same problem:

The masq file is appended to the snat file. So, you can add networks to the masq Webmin form, but you can’t remove them unless you sudo vi /etc/shorewall/snat and delete the entries manually.

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.