# upgrade to kernel 3.7.10 and it broke my iptables/NAT [resol

## dirtbag

i upgraded to  3.7.10-gentoo #1 SMP Tue Mar 12 15:30:56 EDT 2013 i686 AMD Athlon(tm) 64 X2 Dual Core Processor 5200+ AuthenticAMD GNU/Linux

and now, I cant seem to get NAT working with my iptables .. 

```

beast netfilter # iptables -t nat -nL

iptables v1.4.17: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

beast netfilter # iptables -F -t nat 

iptables v1.4.17: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

beast netfilter # iptables -t nat -A POSTROUTING -o eth1 -s 10.1.1.1 -d 0/0 -j MASQUERADE

iptables v1.4.17: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

```

and in dmesg, I see 

```
[  780.624734] nf_nat: Unknown symbol nf_nat_decode_session_hook (err 0)

[  780.626740] nf_nat: Unknown symbol nf_nat_decode_session_hook (err 0)

[  804.025641] nf_nat: Unknown symbol nf_nat_decode_session_hook (err 0)

[  804.027628] nf_nat: Unknown symbol nf_nat_decode_session_hook (err 0)
```

Im sure im missing something in the kernel config, but I cant seem to find it.

-dbLast edited by dirtbag on Thu Mar 14, 2013 12:03 am; edited 1 time in total

----------

## Odward

Going from memory, so could be wrong / incomplete

Check for 

```
--> Networking Support

   --> Networking Options 

      --> Network packet filtering framework (Netfilter) 

         --> IP: Netfilter Configuration

<M> IPv4 NAT
```

I think that was the option to get it working again after upgrading to 3.7.10 for my basic ipv4 home network.

Built-in / module etc. to suit your needs.

----------

## dirtbag

im pretty sure i have that.. 

jason@beast /usr/src/linux $ grep -i NF_NAT .config

CONFIG_NF_NAT=m

CONFIG_NF_NAT_NEEDED=y

CONFIG_NF_NAT_PROTO_DCCP=m

CONFIG_NF_NAT_PROTO_UDPLITE=m

CONFIG_NF_NAT_PROTO_SCTP=m

CONFIG_NF_NAT_AMANDA=m

CONFIG_NF_NAT_FTP=m

CONFIG_NF_NAT_IRC=m

CONFIG_NF_NAT_SIP=m

CONFIG_NF_NAT_TFTP=m

CONFIG_NF_NAT_IPV4=m

CONFIG_NF_NAT_PROTO_GRE=m

CONFIG_NF_NAT_PPTP=m

CONFIG_NF_NAT_H323=m

# CONFIG_NF_NAT_IPV6 is not set

beast 3.7.10-gentoo # insmod /lib/modules/3.7.10-gentoo/kernel/net/netfilter/nf_nat.ko

insmod: ERROR: could not insert module /lib/modules/3.7.10-gentoo/kernel/net/netfilter/nf_nat.ko: Unknown symbol in module

beast 3.7.10-gentoo # 

-db

----------

## depontius

Silly question, but did you modprobe it before trying to use it in the firewall script?

----------

## PaulBredbury

Move the old files away:

```
mv /lib/modules/3.7.10-gentoo{,.old}
```

Then recompile your kernel.

I always do this, to ensure no stale files.

----------

## Hu

 *dirtbag wrote:*   

> beast 3.7.10-gentoo # insmod /lib/modules/3.7.10-gentoo/kernel/net/netfilter/nf_nat.ko
> 
> insmod: ERROR: could not insert module /lib/modules/3.7.10-gentoo/kernel/net/netfilter/nf_nat.ko: Unknown symbol in module
> 
> 

 Why are you using insmod instead of modprobe?  Do you need NAT to be a module instead of built-in?

----------

## dirtbag

im not sure exactly what i did, but I finally got it working 

I think the option in the kernel that did it was 

```
        

                   <*> IPv4 connection tracking support (required for NAT)                                                            

                    [*]   proc/sysctl compatibility with old connection tracking             <----this right here                                      

                  <M> IP Userspace queueing via NETLINK (OBSOLETE)                                                                     

                  <*> IP tables support (required for filtering/masq/NAT)                                                                 

                   <M>   "ah" match support                                         
```

also, I selected 

IPv4 NAT  and MASQUERADE target support

as compiled in instead of modules..

anyway, im back in business again!

-db

----------

## toralf

 *dirtbag wrote:*   

> anyway, im back in business again!
> 
> -db

 yeah - but for the future - did you know now *what* caused the issue ?

----------

## pakjebakmeel

I ran into exactly the same issue last week. I don't use masquerade nor NAT rules in my IP tables so I'm not sure why it's complaining when trying to restore the IP tables after a reboot.

I've done the same and included CONFIG_NF_NAT=y which "fixed" my issue.

----------

