Configurator.c: Timed out waiting for a response

In some scenario cjdns could fail at starting up with the following cryptic messages:

1428440513 DEBUG AdminClient.c:333 Connecting to [127.0.0.1:11234]
1428440513 DEBUG UDPAddrIface.c:294 Bound to address [0.0.0.0:58063]
1428440518 CRITICAL Configurator.c:96 Failed to make function call [Timed out waiting for a response], error: [ping]
1428440518 CRITICAL Configurator.c:56 enable Log_LEVEL=KEYS to see message content.
1428440523 CRITICAL Configurator.c:68 Failed to stop the core.
1428440523 CRITICAL Configurator.c:70 Aborting.

Cause

cjdns is configured via the admin interface, listening by default on localhost, port 11234.

However, there are some machine configurations where the firewall has a default policy different from ACCEPT for the INPUT chain and there's an exception for loopback interface missing. Checking with iptables -t filter -L (as root) should output something like:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

The above output is the default configuration of the firewall, with everything allowed, your own could be configured in many different ways. However, you have to check your INPUT chain policy, if it's REJECT or DROP that could be causing the problem above.

Solution

There are a couple of solutions to this issue.

ACCEPT everything on INPUT

Piece of cake: just run iptables -t filter -P INPUT ACCEPT.

Add an exception for loopback traffic

This solution is more complex, but allows you to retain your full firewall functionality while allowing cjdns at the same time. You have to allow both inbound and outbound traffic on the loopback interface, usually named lo. That name is the one which is going to be used in the following code snippet.

iptables -t filter -I INPUT -i lo -j ACCEPT
iptables -t filter -I INPUT -o lo -j ACCEPT

Ok, I cheated. The rules are really simple: just ACCEPT everything from (-i) or to (-o) loopback interface (lo) on chain INPUT.

Maybe not so simple really...

... and now you can't peer

Just adding an exception for lo is not enough if you want to peer via UDP and you didn't load the conntrack module. Load it or add an exception for the port used by the UDPInterface.

Or just use the first solution.

configurator-timeout.md 2.4 KB 히스토리 Raw