Yunohost-firewall service is unknown and all ports are unreachable

Support
,
1

What type of hardware are you using: Old laptop or computer
What YunoHost version are you running: 12.1.39
How are you able to access your server: The webadmin
SSH
Are you in a special context or did you perform specific tweaking on your YunoHost instance ?: No

Describe your issue

Hi, I have the following issue. All ports are unreachable according to the webadmin (which I am able to reach from the local network), I am unable to reach anything from outside the local network. I can reload the firewall through ssh, but that doesn’t change anything. My server is in DMZ on my router so I don’t think it is an issue with my internet provider. This happened all of a sudden so I don’t know were to begin looking for issues. I found something on the forum about ufw and firewall conflicting, but it seems I do not have ufw on my server?
What steps do I need to take to find the issue?

Weirdly, while I am able to ‘reload’ firewall. If i do the command ‘yunohost service start yunohost-firewall’ It gives the error “error: Unknown service ‘yunohost-firewall’”?

Any ideas how to proceed?

Share relevant logs or error messages

“error: Unknown service ‘yunohost-firewall’”?

2

hi @aven
yunohost firewall manages nftables.service (webadmin>tools>services)

from diagnosis or webadmin>firewall ?

3

Hi otm33, thanks for answering so quickly,

In the diagnosis all ports are said to be unreachable. When I look in the webadmin>firewall, the necessary ports are said to be open (green toggle).

I have a also identified a different problem, when I try to update I get the following errors;

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures couldn’t be verified because the public key is not available: NO_PUBKEY 62D54FD4003F6525

W: Failed to fetch https://dl.yarnpkg.com/debian/dists/stable/InRelease The following signatures couldn’t be verified because the public key is not available: NO_PUBKEY 62D54FD4003F6525

W: Some index files failed to download. They have been ignored, or old ones used instead.

Something went wrong while updating the cache of APT (Debian’s package manager). Here is a dump of the sources.list lines, which might help identify problematic lines:sources.list:deb  bookworm mainsources.list:deb-src  bookworm mainsources.list:deb  bookworm-security mainsources.list:deb-src  bookworm-security mainsources.list:deb  bookworm-updates mainsources.list:deb-src  bookworm-updates mainsources.list.d/extra_php_version.list:deb [signed-by=/etc/apt/trusted.gpg.d/extra_php_version.gpg]  bookworm mainsources.list.d/yarn.list:deb [signed-by=/etc/apt/trusted.gpg.d/yarn.gpg] https://dl.yarnpkg.com/debian/ stable mainsources.list.d/yunohost.list:deb [signed-by=/usr/share/keyrings/yunohost-bookworm.gpg]  bookworm stable

there seems to have been a short power outage which might have occured while the server was updating automatically. However when I run sudo yunohost tools regen-conf postfix --dry-run I get no results either

4

Try running sudo yunohost tools regen-conf apt -f

Then sudo yunohost tools regen-conf --dry-run --with-diff

And share the diagnosis link

5

This one seems to be cause the keyring expired. I solved both PHP & Yarn issue and shared here: https://forum.yunohost.org/t/php-repo-key-expired-solved/41499

6

Sorry, cannot post links, as created a new account for the PHP & Yarn issue just now.

7

The issue with expired keys is normal and common (see here and here).
From outside of your LAN, could you try

nmap -p 443 YOURPUBLICIP

Could your isp have started using CGNAT ?
For testing purpose, could you try moving your ynh from DMZ and setting up portforwarding instead?

8

I ran the two commands and then reran the diagnosis: logs here https://paste.yunohost.org/raw/figuzaduxu

9

This one does not work and hence I created my thread. It kept giving error, and I mentioned that in the xmpp chat room as well.

10

Ok! What’s the difference ?

11

Okay, I just re-checked. I was only trying the “solved answer” part, and did not take the real look at all posts there. My bad. :frowning:

12

No problem, no worries :slightly_smiling_face:

13

The solution seems to be to move the server outside the DMZ, but I do not understand why.

  • after moving to portmapping, the server did connect again (except for the coturn port which never works for reasons I cannot figure out).

  • I did the first solution for the expired keyring, thanks, I was unaware and the issue seems indeed unrelated. First solution works perfectly

  • I have a fixed IP address through my provider and it does not seem that I have CGNAT. Is there I way I could check it for sure?

Is there still a way I could test what went wrong with the DMZ set-up? In any case, many thanks for all the help!! currently it seems workable :slight_smile:

14

If it worked before, it could mean your isp changed DMZ rules: it seems that isp DMZ are not always “real” DMZ.

15

Ok, seems plausable.. worked for a few years till a week ago. I’ll go with port forwarding then from now on. thank you for all the help!