When running tl-setup (4.12.1 and development builds) on a RHEL7
system with firewalld replaced with lokkit we get the following
error in /var/log/tlsetup.log:
> Creating firewall service 'tlwebaccess' using ports 300:TCP
> Enable firewall service 'tlwebaccess'
> Creating firewall service 'tlwebadm' using ports 1010:TCP
> Enable firewall service 'tlwebadm'
> Creating firewall service 'tlmaster' using ports 9000:TCP
> Enable firewall service 'tlmaster'
> Creating firewall service 'tlagent' using ports 904:TCP
> Enable firewall service 'tlagent'
> Enable system firewall service 'ssh'
> Failed to reload firewall configuration
> Failed to start iptables.
> Failed to start ip6tables.
This stems from us doing a burst of calls to lokkit which in turn
results in another burst of restarts of the iptables/ip6tables
systemd services. systemd limits service burst restarts to 5
within a 10 second interval. We hit this ceiling which results in
the iptables/ip6tables services dying and in turn the lokkit
firewall being disabled.
A fix has now been implemented. The changes are to be tested on RHEL7 since later RHEL versions exclusively use firewalld instead of lokkit.
To install lokkit, remove firewalld, and finally enable lokkit on a RHEL7 machine:
> # yum install lokkit
> # yum remove firewalld
> # lokkit --enabled
Running tl-setup on the system should result in the ports used by ThinLinc being marked as ACCEPT in iptables and should all be using TCP:
> # iptables -L
Tested as described in comment #2, with build 2122 on RHEL 7. Looks good!
Release notes also look good.