# IP_TABLES error help please

## arachn1d

I can't get ip_tables to work with my system

keeps giving me errors

An error occured when checking your current IPtables configuration :

modprobe: Can't locate module ip_tables

iptables v1.2.9: can't initialize iptables table `filter': iptables who? (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

This may indicate that your kernel does not support IPtables

This error was by webmin and I recieve same errors from console.

I went through every possible kernel configuration on my system, even adding everythign as modules ( in the ip tables support area )and it still doesnt work I don't know why.

----------

## DaveArb

This is everything that matches IPTAB and FILT from a working firewall/router:

```
CONFIG_IP_NF_IPTABLES=y

CONFIG_NETFILTER=y

CONFIG_IP_NF_FILTER=y

CONFIG_IP_NF_ARPFILTER=y
```

I don't use them as modules, they are compiled into the kernel. Kernel is 2.6.6-rc1.

Dave

----------

## Pachacamac

Oh it is very simple you don't have iptables in your kernel.

You can find your information here

https://forums.gentoo.org/viewtopic.php?t=176792&postdays=0&postorder=asc&start=0

----------

## arachn1d

it'd help if it was english  :Sad: 

btw DaveArb I have no idea what you mean sorry im no guru.

----------

## Pachacamac

Ah okey, you don't speak french ?

I will do a Ctrl + C and Ctrl + v because I am a nice french boy  :Wink: 

 *Quote:*   

> 
> 
> D'apres moi tu n'a pas compiler tout ce qu'il faut pour autoriser iptables a faire du NAT.
> 
>  The translation is : "I think you don't have all you need in your kernel to use NAT with iptables"
> ...

 

It is late here so I will sleep some hours.

Bye

----------

## arachn1d

I have all of that.

The problem is its just that it's not working :'(

----------

## mekong

Just to make sure you have iptables enable on your running kernel.

zcat /proc/config.gz | grep IPTABLES

When I first installed Gentoo, I forget to mount /boot before copy the kernel and keep asking why my new compile kernel didn't work.

----------

## arachn1d

no such file or directory.

----------

## mekong

Oh, config.gz it's an option on kernel. if you don't have it. Check if you have these files:

/proc/net/ip_tables_matches

/proc/net/ip_tables_names

/proc/net/ip_tables_targets

----------

## arachn1d

dont have those

----------

## arachn1d

is that bad? lol  :Evil or Very Mad: 

----------

## DaveArb

Sorry, didn't mean to be cryptic. Your answer to Pachacamac covered my earlier comment.

Perhaps emerging iptables would fix up your problems.

Dave

----------

## Pachacamac

Yes DaveArb I think he miss something. But what ? I don't know.

----------

## arachn1d

re-did it like 6 times.

----------

## splooge

Don't forget to mount /boot before installing the new kernel:

```
mount /boot

cd /usr/src/linux

make bzImage modules modules_install

cp arch/i386/boot/bzImage /boot
```

----------

## mekong

I think your current running kernel don't have iptables enables. Those files on /proc are created by kernel with iptables enable.

----------

## arachn1d

 *splooge wrote:*   

> Don't forget to mount /boot before installing the new kernel:
> 
> ```
> mount /boot
> 
> ...

 

i have both /usr/src/linux and /usr/src/linux-gentoo-src1 etc... which one should i use?

----------

## arachn1d

okay nm i did that now i get this error..

```
An error occured when checking your current IPtables configuration :

/lib/modules/2.4.25-gentoo-r1/kernel/net/ipv4/netfilter/ip_tables.o: /lib/modules/2.4.25-gentoo-r1/kernel/net/ipv4/netfilter/ip_tables.o: unresolved symbol nf_unregister_sockopt

/lib/modules/2.4.25-gentoo-r1/kernel/net/ipv4/netfilter/ip_tables.o: /lib/modules/2.4.25-gentoo-r1/kernel/net/ipv4/netfilter/ip_tables.o: unresolved symbol nf_register_sockopt

/lib/modules/2.4.25-gentoo-r1/kernel/net/ipv4/netfilter/ip_tables.o: insmod /lib/modules/2.4.25-gentoo-r1/kernel/net/ipv4/netfilter/ip_tables.o failed

/lib/modules/2.4.25-gentoo-r1/kernel/net/ipv4/netfilter/ip_tables.o: insmod ip_tables failed

iptables v1.2.9: can't initialize iptables table `filter': iptables who? (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

This may indicate that your kernel does not support IPtables
```

it can't be kernel configuration from the makefile but i guess its some other configuration issue, anyone have any suggestions? thx.

----------

## arachn1d

bumpy

----------

## mekong

Hi, did you compile iptables as modules? Which option on netfilter did you select? just select them all.  You use iptables for firewall right? I would compile it in the kernel instead as module. You need it loaded all the time anyway.

----------

## arachn1d

I loaded them as modules and I selected everything except experimentals.

Please tell me what I would have to do as if you were going to do install iptables

that is mounting whatever the entire process of installing iptables because i keep hearing did u mount boot? blah blah blah im soo confused all I did was bassicaly

cd /usr/src/linux

make menuconfig

(do all the iptables configs)

save and exit

make dep

iptables -L

not working stupid errors....

what would i have to do to make it work? thx.

----------

## splooge

 *splooge wrote:*   

> Don't forget to mount /boot before installing the new kernel:
> 
> ```
> mount /boot
> 
> ...

 

then reboot to your new kernel.

----------

## arachn1d

okay i did that like 500 million times and it didnt work, trying to reemerge blah blah blah ... damnit  :Sad: 

----------

## arachn1d

bump*  :Rolling Eyes: 

----------

## gigel

whoa,this is weird ..

well,i must repeat what others said..

first make sure that /usr/src/linux is pointing to your kernel

compile iptables support into the kernel

after this,make sure in /usr/src/linux/.config

the lines that begin with CONFIG_IP_NF* are ending with "y" or "m" (except de " ,e.g. CONFIG_IP_NF_IPTABLES=m)

next emerge iptables

now what it the output from iptables -A INPUT -j DROP 

and iptables -L

----------

## arachn1d

I have /usr/src/linux and /usr/src/linux-2.4.5-gentoo <--- dunno if thats exact but somethin like that.

which should I use?

still /usr/src/linux?

and how do i make sure its pointing my kernel? thx.

----------

## gigel

what kernel do you want to use?

let suppose you want linux-2.6.6

cd in /usr/src 

and ln -sf linux-2.6.6 linux

----------

## arachn1d

iptables -A INPUT -j DROP

modprobe: Can't locate module ip_tables

iptables v1.2.9: can't initialize iptables table `filter': iptables who? (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

----------

## splooge

post your grub.conf file

----------

## arachn1d

I use lilo

```

boot=/dev/hda

prompt

timeout=50

default=gentoo

image=/boot/kernel-2.4.25-gentoo-r1

        label=gentoo

        read-only

        root=/dev/hda3
```

----------

## splooge

 *arachn1d wrote:*   

> I use lilo
> 
> ```
> 
> boot=/dev/hda
> ...

 

ok then!

The deal is, the new kernel we're making and copying over (/usr/src/linux/arch/i386/boot/bzImage) is called /boot/bzImage, but your bootloader is looking for /boot/kernel-2.4.25-gentoo-r1

there's several ways to fix this, first and foremost change the lilo config file to look for bzImage instead of kernel-2.4.25-gentoo-r1

Change image to read like this:

image=/boot/bzImage

----------

## arachn1d

after doing all that...

still not working

saw something childlevel test line 1 permission denied... or somethin?

when reemerging iptables after i did all that, i had that b4 though iguess.

----------

## gigel

after booting what's the output of uname -a

just to make sure u are using the kenrel you've compiled iptables for!

----------

## arachn1d

```
uname -a

Linux elite-designz.net 2.4.25-gentoo-r1 #1 SMP Fri Apr 16 07:10:06 PDT 2004 i686 AMD Duron(tm) Processor AuthenticAMD GNU/Linux

```

----------

## splooge

make your menu.lst (or whatever it's called in lilo) look like this:

```
boot=/dev/hda 

prompt 

timeout=50 

default=gentoo 

image=/boot/kernel-2.4.25-gentoo-r1 

        label=gentoo 

        read-only 

        root=/dev/hda3

image=/boot/bzImage

        label=new gentoo

        read-only

        root=/dev/hda3
```

----------

## arachn1d

where is that? >_<

----------

## splooge

According to the  GENTOO DOCUMENTATION it's /etc/lilo.conf

----------

## arachn1d

oh i get it lemme try that.

----------

## arachn1d

i doesn't work still....

if it'd make a difference i can let you ssh into the system.. ( im preety desperate )

if you have AIM message me ( if u wanna do it )

Stoned Pandaa is my sn.

Otherwise explain here if u can.

----------

## splooge

/shrug

I can if you want.  PM me here.

BTW did you re-run 'lilo' to load the new /etc/lilo.conf ??  It should have given you a new boot option when booting the computer.

----------

## arachn1d

```
 /sbin/lilo

Fatal: open /boot/kernel-2.4.25-gentoo-r1: No such file or directory

```

did mount /boot

```
/sbin/lilo

Added gentoo *

Unrecognized token "gentoo" at or above line 13 in file '/etc/lilo.conf'

```

fixed by adding a - to the new gentoo

now new-gentoo.

(rebooting now)

----------

## arachn1d

rebooted remerged iptables...

still no luck...  :Sad: 

----------

## gigel

 *arachn1d wrote:*   

> rebooted remerged iptables...
> 
> still no luck... 

 

follow all the steps posted here,it's impossible not to fix your problem

reboot

uname -a

is this the kernel?if no reboot

if it is make the symlink in /usr/src

reemerge iptables

if now iptables -A INPUT -j DROP fails

then make sure u've enabled everyting in your current kernel

----------

## boglin

This is wierd, I am getting the same problem. I know my profile says noob, but I have done iptables before (or so I thought).

Check out my .config:

```

CONFIG_NETFILTER=y

# CONFIG_NETFILTER_DEBUG is not set

CONFIG_IP_NF_IPTABLES=m

CONFIG_IP_NF_NAT=m

CONFIG_IP_NF_NAT_NEEDED=y

```

I modprobe'd ip_tables,iptable_nat,ip_conntrack:

```

#lsmod|head -n 4

Module                  Size  Used by    Not tainted

iptable_nat            18150   0  (unused)

ip_conntrack           24064   1  [iptable_nat]

ip_tables              13440   3  [iptable_nat]

```

and emerge'd iptables.

```

#emerge -p iptables

These are the packages that I would merge, in order:

Calculating dependencies ...done!

[ebuild   R   ] net-firewall/iptables-1.2.9

```

So you'd figure that iptables -L, or iptables -A INPUT -j DROP would work, right?

```

#iptables -A INPUT -j DROP

iptables v1.2.9: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

```

can i get some version information from the previous posters? maybe iptables 1.2.9 is incompatible with my kernel:

```

#uname -a

Linux mothership 2.4.23-ck1 #1 SMP Tue Jun 1 19:07:18 EDT 2004 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux

```

----------

## splooge

Well heh you need the module that drops packets if you're gonna -j DROP!

CONFIG_IP_NF_FILTER

AKA Packet filtering.

----------

## arachn1d

```
uname -a

Linux elite-designz.net 2.4.25-gentoo-r1 #1 SMP Fri Apr 16 07:10:06 PDT 2004 i686 AMD Duron(tm) Processor AuthenticAMD GNU/Linux

```

This is the right kernel I suppose, what else could it be? (I only installed the gentoo one from the disc)

And how do I do a symlink?

thx.

----------

## splooge

Well, the answer is in this post, somewhere.  It has to be.  There's absolutely no other reason it would not work.

PM me an account I can ssh in with and I'll check it out.

----------

## arachn1d

hmm okay. pM'd you

----------

## To

shorewall has nice help page for what modules and how you can cpole them. If you're able to do this you will have the necessary modules to run almost any iptables firewall you coul thing of.

http://www.shorewall.net

NOTE: Check if you really updating your kernel. I saw ppl copiling and copiling new kernel versions and complaning that it wasn't working, some for stupid things, like didn't mounted /boot but the image never got updated  :Wink: 

Tó

----------

## arachn1d

oh ok thanks

----------

## stonent

I'm having similar problems...

```
Aurora root # iptables -A INPUT -j DROP

FATAL: Module ip_tables not found.

iptables v1.2.9: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

Aurora root # iptables -L              

FATAL: Module ip_tables not found.

iptables v1.2.9: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

Aurora root # 

```

```
Aurora linux-2.6.7-gentoo-r8 # gzcat /proc/config.gz | grep _IP_

CONFIG_IP_MULTICAST=y

# CONFIG_IP_ADVANCED_ROUTER is not set

# CONFIG_IP_PNP is not set

# CONFIG_IP_MROUTE is not set

# CONFIG_IP_VS is not set

CONFIG_IP_NF_CONNTRACK=y

# CONFIG_IP_NF_FTP is not set

# CONFIG_IP_NF_IRC is not set

# CONFIG_IP_NF_TFTP is not set

# CONFIG_IP_NF_AMANDA is not set

# CONFIG_IP_NF_QUEUE is not set

CONFIG_IP_NF_IPTABLES=y

# CONFIG_IP_NF_MATCH_LIMIT is not set

# CONFIG_IP_NF_MATCH_IPRANGE is not set

# CONFIG_IP_NF_MATCH_MAC is not set

# CONFIG_IP_NF_MATCH_PKTTYPE is not set

CONFIG_IP_NF_MATCH_MARK=y

# CONFIG_IP_NF_MATCH_MULTIPORT is not set

# CONFIG_IP_NF_MATCH_TOS is not set

# CONFIG_IP_NF_MATCH_RECENT is not set

# CONFIG_IP_NF_MATCH_ECN is not set

# CONFIG_IP_NF_MATCH_DSCP is not set

# CONFIG_IP_NF_MATCH_AH_ESP is not set

# CONFIG_IP_NF_MATCH_LENGTH is not set

# CONFIG_IP_NF_MATCH_TTL is not set

# CONFIG_IP_NF_MATCH_TCPMSS is not set

# CONFIG_IP_NF_MATCH_HELPER is not set

# CONFIG_IP_NF_MATCH_STATE is not set

# CONFIG_IP_NF_MATCH_CONNTRACK is not set

# CONFIG_IP_NF_MATCH_OWNER is not set

# CONFIG_IP_NF_FILTER is not set

CONFIG_IP_NF_NAT=y

CONFIG_IP_NF_NAT_NEEDED=y

CONFIG_IP_NF_TARGET_MASQUERADE=y

# CONFIG_IP_NF_TARGET_REDIRECT is not set

# CONFIG_IP_NF_TARGET_NETMAP is not set

# CONFIG_IP_NF_TARGET_SAME is not set

# CONFIG_IP_NF_NAT_LOCAL is not set

# CONFIG_IP_NF_NAT_SNMP_BASIC is not set

# CONFIG_IP_NF_MANGLE is not set

# CONFIG_IP_NF_TARGET_LOG is not set

# CONFIG_IP_NF_TARGET_ULOG is not set

# CONFIG_IP_NF_TARGET_TCPMSS is not set

# CONFIG_IP_NF_ARPTABLES is not set

# CONFIG_IP_NF_RAW is not set

# CONFIG_IP_SCTP is not set

Aurora linux-2.6.7-gentoo-r8 # 
```

```
Aurora root # ls /proc/net -alhF

total 0

dr-xr-xr-x    4 root root 0 Jul  8 15:45 ./

dr-xr-xr-x  147 root root 0 Jul  8 09:06 ../

-r--r--r--    1 root root 0 Jul  8 15:50 arp

-r--r--r--    1 root root 0 Jul  8 15:50 dev

-r--r--r--    1 root root 0 Jul  8 15:50 dev_mcast

-r--r--r--    1 root root 0 Jul  8 15:50 igmp

-r--r--r--    1 root root 0 Jul  8 15:50 ip_conntrack

-r--r--r--    1 root root 0 Jul  8 15:50 ip_tables_matches

-r--r--r--    1 root root 0 Jul  8 15:50 ip_tables_names

-r--r--r--    1 root root 0 Jul  8 15:50 ip_tables_targets

-r--r--r--    1 root root 0 Jul  8 15:50 mcfilter

-r--r--r--    1 root root 0 Jul  8 15:50 netlink

-r--r--r--    1 root root 0 Jul  8 15:50 netstat

dr-xr-xr-x    3 root root 0 Jul  8 15:50 p80211/

-r--r--r--    1 root root 0 Jul  8 15:50 packet

-r--r--r--    1 root root 0 Jul  8 15:50 raw

-r--r--r--    1 root root 0 Jul  8 15:50 route

dr-xr-xr-x    8 root root 0 Jul  8 15:50 rpc/

-r--r--r--    1 root root 0 Jul  8 15:50 rt_cache

-r--r--r--    1 root root 0 Jul  8 15:50 rt_cache_stat

-r--r--r--    1 root root 0 Jul  8 15:50 snmp

-r--r--r--    1 root root 0 Jul  8 15:50 sockstat

-r--r--r--    1 root root 0 Jul  8 15:50 softnet_stat

-r--r--r--    1 root root 0 Jul  8 15:50 tcp

-r--r--r--    1 root root 0 Jul  8 15:50 udp

-r--r--r--    1 root root 0 Jul  8 15:50 unix

-r--r--r--    1 root root 0 Jul  8 15:50 wireless
```

I even upgraded iptables

```
Aurora root # iptables -A INPUT -j DROP

FATAL: Module ip_tables not found.

iptables v1.2.11: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

Aurora root # iptables -L

FATAL: Module ip_tables not found.

iptables v1.2.11: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

Aurora root # 
```

----------

## splooge

```
# CONFIG_IP_NF_FILTER is not set
```

----------

