Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
iptables v1.8.2 (legacy): can't initialize iptables table
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
samuelbernardo
n00b
n00b


Joined: 30 Jan 2016
Posts: 19

PostPosted: Sun Apr 07, 2019 4:28 pm    Post subject: iptables v1.8.2 (legacy): can't initialize iptables table Reply with quote

Hi,

Today after gentoo upgrade I realize that libvirt have an error in the startup. Iptables are not working as expected and because of that libvirt can't set the forward rules for nat bridges.

The related ebuilds I've installed are:
net-firewall/iptables-1.8.2-r2 conntrack ipv6 netlink pcap -nftables
net-firewall/nftables-0.9.0-r4 gmp json modern_kernel readline
net-firewall/ebtables-2.0.10.4 +perl
app-emulation/libvirt-5.1.0 caps dbus fuse libvirtd lvm lxc macvtap nfs nls parted policykit qemu sasl udev vepa virt-network wireshark-plugins zfs
sys-kernel/gentoo-sources-4.19.34 experimental

I've iptables enabled with almost all other options:
grep NF_IPTABLES /boot/config-$(uname -r)
CONFIG_IP_NF_IPTABLES=y
CONFIG_IP6_NF_IPTABLES=y

I've also enable ebtables and nftables related options in kernel.
nft commands work without any problem, such as ebtables. Only iptables have this error.
I can't enable use flag nftables in iptables ebuild because libvirt requires iptables with nftables flag disabled.

Does anyone have an hint for the reason why the following error happens?

Code:

# iptables -nvL
iptables v1.8.2 (legacy): can't initialize iptables table `filter': No child processes                                                 
Perhaps iptables or your kernel needs to be upgraded.


Conplete kernel configuration: https://pastebin.com/TDpwKij0

Code:

# cat /proc/net/ip_tables_names
security
raw
nat
mangle
filter


Thanks
Back to top
View user's profile Send private message
deagol
n00b
n00b


Joined: 12 Jul 2014
Posts: 19

PostPosted: Sat Apr 13, 2019 8:56 pm    Post subject: Reply with quote

You probably missing some kernel module(s)

I had the exactly same error message today after updating my kernel. I used the old kernel config as base and with the new kernel I got the same error.
If I'm right booting your old kernel will allow iptables to work again.
You then have to figure out exactly what's missing... In my case MASQUERADE target was missing. A master option was off, MASQUERADE was one of selectable targets.
Doesn't look like that's your problem, though...
But when you can confirm that it's still working with the old kernel something next to sure is...
Back to top
View user's profile Send private message
samuelbernardo
n00b
n00b


Joined: 30 Jan 2016
Posts: 19

PostPosted: Sun Apr 14, 2019 12:27 am    Post subject: Reply with quote

deagol wrote:
You probably missing some kernel module(s)

I had the exactly same error message today after updating my kernel. I used the old kernel config as base and with the new kernel I got the same error.
If I'm right booting your old kernel will allow iptables to work again.
You then have to figure out exactly what's missing... In my case MASQUERADE target was missing. A master option was off, MASQUERADE was one of selectable targets.
Doesn't look like that's your problem, though...
But when you can confirm that it's still working with the old kernel something next to sure is...


Thanks for your feedback.
Unfortunately I have already MASQUERADE target enabled.
I have an hint that the problem maybe related to iptables nftables flag that I can't activate because libvirt and lxd still depend on ebtables that brings a conflict to iptables with nftables.
So my firewall now is being configured by nft that is working as expected. libvirtd gives warnings when starting because of iptables command errors, but is still working.
My hope now is libvirt and lxd start to support nftables.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum