The init script of net-firewall/iptables-1.3.5-r4 (and maybe other versions) contains the following lines in the stop-function: ## ebegin "Stopping firewall" ## for a in $(<${iptables_proc}) ; do ## ${iptables_bin} -F -t $a ## ${iptables_bin} -X -t $a ## ## set_table_policy $a ACCEPT ## done A simple iptables setup for a diskless setup will allow traffic from localhost, from the server and for connections opened by the user: ## iptables -A INPUT -i lo -j ACCEPT ## iptables -A INPUT -s <server-ip> -j ACCEPT ## iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT and then use the policy to prevent any further incoming connections: ## iptables -P INPUT DROP When calling "/etc/init.d/iptables stop", this setup will result in the machine locking up after the first flushing call "${iptables_bin} -F", because any NFS-traffic is blocked by the default policy, which cannot be reset to "ACCEPT" as the binary is no longer available. As a workaround, I changed the order of commands in /etc/init.d/iptables to set the table policy before flushing the table. This works fine for my simple diskless client, but I am not sure if other imaginable configurations would have trouble with it, like a complex ruleset for a firewall/NAT machine with custom tables that contain rewriting rules which should be deleted before changing the policy. I never had the reason to set up something like that and just don't know if it might have undesired effects. While experimenting, I also tried disabling the problematic commands entirely, because my clients do not save the rules and work fine without stopping the firewall on shutdown. But other setups (like logging) would fail on syslog shutdown. My suggestion would be to add an option like "STOP_ON_SHUTDOWN" to /etc/conf.d/iptables to allow customization as desired. The init script should also check if "/" is network mounted and act accordingly ("nfsmount" already does this on shutdown). Until then, one of the workarounds should do fine.
Just checked and found that I misremembered the problems with init scripts: "nfsmount" reports errors on unmounting the busy filesystems, it is "net.lo" (symlink net.eth0) that checks if the root filesystem is network mounted, using "is_net_fs". Dito for "checkroot" which uses the same function. Sorry for any confusion.
*** This bug has been marked as a duplicate of 154269 ***
Sorry about the duplicate, I failed to search for fixed bugs as the problem persists (I did not get the update because it does not show up on "emerge -uD world").
