# iptables complaining about no "icmp" extension found

## Philippe23

When I restart iptables, I'm getting this error:

```
/usr/lib64/xtables/libipt_icmp.so: no "icmp" extension found for this protocol
```

Can anyone decode for me what it's complaining about?  Am I missing a kernel option or something else?

```
:icmp - [0:0]

[45:2160] -A INPUT -s 169.254.0.0/16 -j REJECT --reject-with icmp-port-unreachable

[341:19312] -A INPUT -s 172.16.0.0/12 -j REJECT --reject-with icmp-port-unreachable

[12595:1442565] -A INPUT -p icmp -j icmp

[2608:139281] -A icmp -p icmp -m icmp --icmp-type 8 -j ACCEPT

[1:96] -A icmp -p icmp -m icmp --icmp-type 3/4 -j ACCEPT

[9874:1295355] -A icmp -p icmp -m icmp --icmp-type 3 -j ACCEPT

[0:0] -A icmp -p icmp -m icmp --icmp-type 4 -j ACCEPT

[0:0] -A icmp -p icmp -m icmp --icmp-type 12 -j ACCEPT

[73:4852] -A icmp -p icmp -m icmp --icmp-type 11 -j ACCEPT

[22:1616] -A icmp -p icmp -j DROP
```

----------

## Thistled

Hi Philippe23

I might be totally crazy for asking this but, have you enabled Xtables in your kernel?

In the kernel config, you will find it here:

```
Networking support  

-> Networking options  

 -> Network packet filtering framework

  -> Core Netfilter Configuration
```

----------

## Philippe23

I'm pretty sure it is: CONFIG_NETFILTER_XTABLES=y

```
#

# Core Netfilter Configuration

#

CONFIG_NETFILTER_NETLINK=y

CONFIG_NETFILTER_NETLINK_QUEUE=y

CONFIG_NETFILTER_NETLINK_LOG=y

CONFIG_NF_CONNTRACK=y

CONFIG_NF_CONNTRACK_MARK=y

CONFIG_NF_CONNTRACK_SECMARK=y

CONFIG_NF_CONNTRACK_EVENTS=y

CONFIG_NF_CONNTRACK_TIMESTAMP=y

# CONFIG_NF_CT_PROTO_DCCP is not set

# CONFIG_NF_CT_PROTO_SCTP is not set

# CONFIG_NF_CT_PROTO_UDPLITE is not set

# CONFIG_NF_CONNTRACK_AMANDA is not set

CONFIG_NF_CONNTRACK_FTP=y

# CONFIG_NF_CONNTRACK_H323 is not set

CONFIG_NF_CONNTRACK_IRC=y

CONFIG_NF_CONNTRACK_BROADCAST=m

CONFIG_NF_CONNTRACK_NETBIOS_NS=m

CONFIG_NF_CONNTRACK_SNMP=m

# CONFIG_NF_CONNTRACK_PPTP is not set

# CONFIG_NF_CONNTRACK_SANE is not set

# CONFIG_NF_CONNTRACK_SIP is not set

# CONFIG_NF_CONNTRACK_TFTP is not set

CONFIG_NF_CT_NETLINK=y

# CONFIG_NETFILTER_TPROXY is not set

CONFIG_NETFILTER_XTABLES=y

#

# Xtables combined modules

#

CONFIG_NETFILTER_XT_MARK=y

CONFIG_NETFILTER_XT_CONNMARK=y

#

# Xtables targets

#

# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set

# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set

CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y

CONFIG_NETFILTER_XT_TARGET_CONNMARK=y

CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y

# CONFIG_NETFILTER_XT_TARGET_CT is not set

# CONFIG_NETFILTER_XT_TARGET_DSCP is not set

# CONFIG_NETFILTER_XT_TARGET_HL is not set

CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y

CONFIG_NETFILTER_XT_TARGET_LED=y

CONFIG_NETFILTER_XT_TARGET_MARK=y

CONFIG_NETFILTER_XT_TARGET_NFLOG=y

CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y

# CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set

CONFIG_NETFILTER_XT_TARGET_RATEEST=y

# CONFIG_NETFILTER_XT_TARGET_TEE is not set

# CONFIG_NETFILTER_XT_TARGET_TRACE is not set

CONFIG_NETFILTER_XT_TARGET_SECMARK=y

# CONFIG_NETFILTER_XT_TARGET_TCPMSS is not set

# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set

# Xtables matches

#

CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y

# CONFIG_NETFILTER_XT_MATCH_CLUSTER is not set

CONFIG_NETFILTER_XT_MATCH_COMMENT=y

CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y

CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y

CONFIG_NETFILTER_XT_MATCH_CONNMARK=y

CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y

# CONFIG_NETFILTER_XT_MATCH_CPU is not set

# CONFIG_NETFILTER_XT_MATCH_DCCP is not set

# CONFIG_NETFILTER_XT_MATCH_DEVGROUP is not set

# CONFIG_NETFILTER_XT_MATCH_DSCP is not set

# CONFIG_NETFILTER_XT_MATCH_ESP is not set

CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y

CONFIG_NETFILTER_XT_MATCH_HELPER=y

# CONFIG_NETFILTER_XT_MATCH_HL is not set

CONFIG_NETFILTER_XT_MATCH_IPRANGE=y

CONFIG_NETFILTER_XT_MATCH_LENGTH=y

CONFIG_NETFILTER_XT_MATCH_LIMIT=y

CONFIG_NETFILTER_XT_MATCH_MAC=y

CONFIG_NETFILTER_XT_MATCH_MARK=y

CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y

# CONFIG_NETFILTER_XT_MATCH_OSF is not set

CONFIG_NETFILTER_XT_MATCH_OWNER=y

CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y

CONFIG_NETFILTER_XT_MATCH_QUOTA=y

CONFIG_NETFILTER_XT_MATCH_RATEEST=y

CONFIG_NETFILTER_XT_MATCH_REALM=y

CONFIG_NETFILTER_XT_MATCH_RECENT=y

# CONFIG_NETFILTER_XT_MATCH_SCTP is not set

CONFIG_NETFILTER_XT_MATCH_STATE=y

CONFIG_NETFILTER_XT_MATCH_STATISTIC=y

CONFIG_NETFILTER_XT_MATCH_STRING=y

# CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set

CONFIG_NETFILTER_XT_MATCH_TIME=y

CONFIG_NETFILTER_XT_MATCH_U32=y

# CONFIG_IP_SET is not set

# CONFIG_IP_VS is not set

#

# IP: Netfilter Configuration

#

CONFIG_NF_DEFRAG_IPV4=y

CONFIG_NF_CONNTRACK_IPV4=y

CONFIG_NF_CONNTRACK_PROC_COMPAT=y

# CONFIG_IP_NF_QUEUE is not set

CONFIG_IP_NF_IPTABLES=y

# CONFIG_IP_NF_MATCH_AH is not set

# CONFIG_IP_NF_MATCH_ECN is not set

# CONFIG_IP_NF_MATCH_TTL is not set

CONFIG_IP_NF_FILTER=y

CONFIG_IP_NF_TARGET_REJECT=y

CONFIG_IP_NF_TARGET_LOG=y

CONFIG_IP_NF_TARGET_ULOG=m

CONFIG_NF_NAT=m

CONFIG_NF_NAT_NEEDED=y

CONFIG_IP_NF_TARGET_MASQUERADE=m

# CONFIG_IP_NF_TARGET_NETMAP is not set

CONFIG_IP_NF_TARGET_REDIRECT=m

# CONFIG_NF_NAT_SNMP_BASIC is not set

CONFIG_NF_NAT_FTP=m

CONFIG_NF_NAT_IRC=m

# CONFIG_NF_NAT_TFTP is not set

# CONFIG_NF_NAT_AMANDA is not set

# CONFIG_NF_NAT_PPTP is not set

# CONFIG_NF_NAT_H323 is not set

# CONFIG_NF_NAT_SIP is not set

CONFIG_IP_NF_MANGLE=y

# CONFIG_IP_NF_TARGET_CLUSTERIP is not set

# CONFIG_IP_NF_TARGET_ECN is not set

# CONFIG_IP_NF_TARGET_TTL is not set

CONFIG_IP_NF_RAW=y

CONFIG_IP_NF_SECURITY=y

CONFIG_IP_NF_ARPTABLES=y

CONFIG_IP_NF_ARPFILTER=y

CONFIG_IP_NF_ARP_MANGLE=y

# CONFIG_IP_DCCP is not set

# CONFIG_IP_SCTP is not set

# CONFIG_RDS is not set

# CONFIG_TIPC is not set

# CONFIG_ATM is not set

# CONFIG_L2TP is not set

# CONFIG_BRIDGE is not set

# CONFIG_NET_DSA is not set

# CONFIG_VLAN_8021Q is not set

# CONFIG_DECNET is not set

CONFIG_LLC=m

# CONFIG_LLC2 is not set

CONFIG_IPX=m

# CONFIG_IPX_INTERN is not set

CONFIG_ATALK=m

# CONFIG_DEV_APPLETALK is not set

# CONFIG_X25 is not set

# CONFIG_LAPB is not set

# CONFIG_WAN_ROUTER is not set

# CONFIG_PHONET is not set

# CONFIG_IEEE802154 is not set

CONFIG_NET_SCHED=y
```

----------

## cach0rr0

 *Philippe23 wrote:*   

> 
> 
> ```
> [12595:1442565] -A INPUT -p icmp -j icmp
> ```
> ...

 

shouldn't this be -j ACCEPT or some other chain? I don't think -j icmp is valid

----------

## Philippe23

"icmp" is the name of my chain that deals with ICMP traffic.

----------

## Napalm Llama

I'm getting this as well; did you ever figure out what was causing it?

----------

## Philippe23

Nope.  I still get it.

----------

## wcg

Who is complaining, iptables or the kernel (what is the source of the error

message)? If it is iptables, you should be able to strace it or run it in

gdb (emerge it with debug information enabled in CFLAGS first, don't

strip it, etc; -ggdb in CFLAGS and FEATURES="splitdebug" in

/etc/portage/make.conf is handy for this) and see what iptables

function is complaining, what it is looking for and not finding, etc.

http://www.gentoo.org/proj/en/qa/backtraces.xml

----------

