| View previous topic :: View next topic |
| Author |
Message |
redblade7
Tux's lil' helper
Joined: 11 Jan 2018
Posts: 104
|
 Posted: Mon May 01, 2023 9:15 pm Post subject: iptables: "Extension state is not supported" |
 |
|
I ran iptables -L the other day and noticed that some of my rules using -m state suddenly give this warning message after the rule is listed:
"Warning: Extension state is not supported, missing kernel module?"
The state module (actually it's not a module but compiled in) was never disabled in the kernel, I enabled the "conntrack" USE flag too and its required CONFIG_NF_CT_NETLINK, and it's still showing this message. I'm not sure if the rules are working or not, and "-m state -h" shows the correct syntax of the state module.
Anyone know more? |
|
| Back to top |
|
 |
alamahant
Advocate
Joined: 23 Mar 2019
Posts: 3879
|
| Posted: Thu May 04, 2023 2:12 pm Post subject: |
|
|
Plz see
[url]
https://wiki.gentoo.org/wiki/Iptables#Kernel
[/url]
It is missing the state functionality.
Plz add it
| Code: |
[*] Network packet filtering framework (Netfilter) --->
--- Network packet filtering framework (Netfilter)
[ ] Network packet filtering debugging
[ ] Advanced netfilter configuration
Core Netfilter Configuration --->
<M> Netfilter LOG over NFNETLINK interface
<*> Netfilter connection tracking support
[ ] Supply CT list in procfs (OBSOLETE)
< > FTP protocol support
< > IRC protocol support
< > NetBIOS name service protocol support
< > SIP protocol support
< > Connection tracking netlink interface
< > Netfilter nf_tables support
-*- Netfilter Xtables support (required for ip_tables)
*** Xtables combined modules ***
< > nfmark target and match support
*** Xtables targets ***
< > LOG target support
< > "NFLOG" target support
< > "TCPMSS" target support
*** Xtables matches ***
<*> "conntrack" connection tracking match support
< > IPsec "policy" match support
<*> "state" match support ########HERE
|
recompile and reinstall kernel and modules.
_________________
 |
|
| Back to top |
|
|
redblade7
Tux's lil' helper
Joined: 11 Jan 2018
Posts: 104
|
| Posted: Thu May 04, 2023 10:40 pm Post subject: |
|
|
| It already is enabled in the kernel. |
|
| Back to top |
|
|
alamahant
Advocate
Joined: 23 Mar 2019
Posts: 3879
|
| Posted: Fri May 05, 2023 9:26 am Post subject: |
|
|
Do you have
| Code: |
CONFIG_NETFILTER_XT_MATCH_STATE |
in your .config?
Can you plz double check?
_________________
|
|
| Back to top |
|
|
pietinger
Moderator
Joined: 17 Oct 2006
Posts: 4148
Location: Bavaria
|
| Posted: Fri May 05, 2023 12:11 pm Post subject: |
|
|
redblade7,
my suggestion is the same as I always say: Enable ALL netfilter modules as <M>odule in your kernel configuration (and enable also "Advanced netfilter configuration"). As soon as your firewall starts (independent if "iptables" or "nftables") all needed modules will be loaded automatically and you can see with "lsmod" which of them you really need. Afterwards you can disable all modules again which you dont need.
(see also here: https://wiki.gentoo.org/wiki/User:Pietinger/Tutorials/Manual_Configuring_Kernel_Version_6.1#Part_2_-_Slim_kernel )
P.S.: Dont forget netfilter-modules for IPv6 ...  (If you use it) |
|
| Back to top |
|
|
r_pns
n00b
Joined: 02 Jul 2006
Posts: 33
|
| Posted: Sat May 20, 2023 1:55 pm Post subject: |
|
|
Apparently, I've found the root cause for this issue (which I've faced too). I've set:
| Code: |
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
# CONFIG_NETFILTER_XT_MATCH_STATE is not set
|
And now, my configuration like
| Code: |
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
works without a warning. According to the docs, the former module supersedes the latter one. |
|
| Back to top |
|
|
redblade7
Tux's lil' helper
Joined: 11 Jan 2018
Posts: 104
|
| Posted: Sun Jul 02, 2023 3:26 am Post subject: |
|
|
| r_pns wrote: | Apparently, I've found the root cause for this issue (which I've faced too). I've set:
| Code: |
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
# CONFIG_NETFILTER_XT_MATCH_STATE is not set
|
And now, my configuration like
| Code: |
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
works without a warning. According to the docs, the former module supersedes the latter one. |
That works for me. Thank you! |
|
| Back to top |
|
|
|
Networking & Security
