# iptables invalid argument..

## zeky

Hi.

I've decided to share a short story with you, because browsing the forum i see ppl having problems with iptables (unresolved symbols...) over and over again.

Well, the scanario was that one of the SuSE servers running (dhcp, dns, ipsec, pppoe, firewall) was dead and filesystem (reiserfs) was corrupt. Since there was no time to screw around repairing that poor litle box (P100, 32Mb ram) i decided to install a fresh new copy of gentoo on a new machine. Well it took me some time to install it and merged allthe packages i needed. This was the easy part. Well, the first thing that i was scared aboutr was iptables. And i was right. Seeing "unresolved symbols" scared the shit out of me. I knew that it will tkae some time to fix this. So i started trying different versions of iptables with my kernel (gentoo-sources-2.4.20), but no luck. In the meantime i found _SO_MANY_ of posts here, ppl having the same problem, but no ultimate solution for this. The next step was  emerging gentoo-test-sources-2.4.22 and trying to make iptables work again. No luck. I started to panic and took another beer from the fridge. Than it came to me, that i need to reemerge iptables in order for iptables to work. Done that and cross my fingers. FINALY!!!! God, i was really swetting my balls off loosing time with all that compiling time....

So, bottom line of this story is that if you're experiences problems with iptables try this steps:

1) make sure all the modules are included in the kernel

2) reemerge iptables

3) change your kernel! (i think there is no other way)

I rememebr installing iptables on gentto about 10 times, and was expiriences problems at least 6 time.

Oh yea, and i allmost forgot...  Getting error "invalid argument" while trying to make NAT on your pppoe server means (in my case) that you need to reemerge iptables. That worked for me. 

Well, i've finnaly complited my mission and it's time for me to relax and have a beer or two. 

Hope anyone can find something usefull in this short story.

May the iptables be with you  :Smile: 

edit - title changed from iptables problems (over and over again) to iptables invalid argument - masseya 

----------

## neilhwatson

Iptables contains patch code for the linux kernel.  If you install iptables by hand you would:

1.  Patch kernel with iptables patch-o-matic.

2.  Build new kernel and/or iptables modules.

3.  Boot to new kernel and/or load iptables modules.

4.  Build and install iptables.

Presumably, if you emerge iptables, it may or may not touch your kernel source.  Can any portage experts elighten us?

----------

## Ari Rahikkala

Yep, iptables is kinda (in)famous for tending to be incompatible between different kernel versions. Not to mention that, IIRC, I had to run a CVS snapshot of iptables to make it work with some development kernel a while ago, before iptables 1.2.8 was released. I wonder if there are any plans to stabilise the netfilter APIs any time soon...

----------

## CrunchyB

Re-emerging did the trick  :Smile: 

I was worried there for a second.

----------

## Mnemia

The reason for this, as mentioned above, is that iptables has both a kernel and userspace component. Each needs to be totally compatible with each other and the kernel part needs to be compatible with the rest of the kernel.

I wrote a custom iptables module once, and it was a real pain keeping it compatible with both the changing kernel versions and the changing iptables version.

So what this all adds up to is that there are lot of things that can break; that's why iptables is so "fragile".

----------

## mor22

If people stil have unresolved symbol problems then try following this post

https://forums.gentoo.org/viewtopic.php?t=3913

Hope it helps

----------

## masseya

I'm making this thread sticky and moving it here from Off The Wall.  I've also changed the title of the thread to more accurately reflect the issue.  Thanks to nephros for pointing out the dupes.  Hopefully, having this thread will prevent future dup postings.

 *nephros wrote:*   

> These are a couple of dupes regarding the recent (and past) breakage of iptables with newer gentoo-sources (fix is to recompile iptables with correct "linux" symlink):
> 
> https://forums.gentoo.org/viewtopic.php?t=128430&highlight=iptables+invalid+argument
> 
> https://forums.gentoo.org/viewtopic.php?t=123929&highlight=iptables+invalid+argument
> ...

 

----------

## JoeG

Setting up iptables is pretty straightforward, and infinitely scriptable.  Get it straight from the horse's mouth here (http://www.netfilter.org/documentation/index.html).

  Linux Magazine http://www.linux-mag.com (I think it's Linux Magazine...I'll double-check my pubs and update)also has a great article on using Netfilter in conjunction with other software to help tame P2P applications.

Here are some more links for "how to":

link

http://www.linuxguruz.com/iptables/

And some for firewall-specific Linux software:

http://www.smoothwall.org/

http://leaf.sourceforge.net/

http://rcf.mvlan.net/

I'd be happy help out in person, if anyone needs it.

--Joe

----------

## uraes

I just write here because I think these things were related all:

nvidia strange behaviour...

iptables didn't compile...

glx problems...

More correctly - most of problems started lately after there were a lot of updates in portage (glibc included). So, after emerge -u world didnt nvidida install anymore. I recompiled linux-headers, xfree, nvidia (NVIDIA-Linux-x86-1.0-5336-pkg1.run), glibc but it didn't help. Then I recompiled kernel and modules and think what? No problems anymore - nvidia and iptables are compiled and working:)

Urmas

----------

## mobilejimbo

I've tried everything in the forum concerning the unresolved symbols and such with exception to patch-o-matic (I saw a patch concerning iptables in the patches.txt of 2.4.22-gentoo-r5).  Is it really effective and will it break this kernel?  

The output when I tried to enter a rule at the command line after an apparently unsuccessful compile:

bash-2.05b# iptables -P INPUT DROP

/lib/modules/2.4.22-gentoo-r5/kernel/net/ipv4/netfilter/ip_tables.o: /lib/modules/2.4.22-gentoo-r5/kernel/net/ipv4/netfilter/ip_tables.o: unresolved symbol nf_unregister_sockopt

/lib/modules/2.4.22-gentoo-r5/kernel/net/ipv4/netfilter/ip_tables.o: /lib/modules/2.4.22-gentoo-r5/kernel/net/ipv4/netfilter/ip_tables.o: unresolved symbol nf_register_sockopt

/lib/modules/2.4.22-gentoo-r5/kernel/net/ipv4/netfilter/ip_tables.o: insmod /lib/modules/2.4.22-gentoo-r5/kernel/net/ipv4/netfilter/ip_tables.o failed

/lib/modules/2.4.22-gentoo-r5/kernel/net/ipv4/netfilter/ip_tables.o: insmod ip_tables failed

iptables v1.2.9: can't initialize iptables table `filter': iptables who? (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

I've recompiled my kernel along with alsa so many times, the last thing I really want to do at this point is compile my kernel squeaky clean!  Everything applicable for network and netfilter is compiled as modules.  Those items not permitted to compile as modules are compiled into the kernel.

Another cryptic note, I've seen really good documentation on firewall scripts.  The only things they were missing were key items for people used to being spoonfed by other distros with information such as "name this cool script 'this particular cool name' and place it in 'this cool place here' to get your rules going...."  

And another note.... Why will the machine tell me to create rules before iptables can run, then fail when I try to create a rule?

----------

## pikkumyy

I too had the "iptables: Invalid argument" thingie with nat rules. This happened after upgrading to iptables 1.2.9, which required to change symlink from my current 2.4.20 kernel to 2.4.22. After that it compiled fine, but after restart natting didn't work. I could see all the nat-tables prerouting+postrouting chains empty, and my previous set of rules didn't load.

I guess this could have been solved by upgrading to a 2.4.22 kernel, but becouse iptables seemed to work fine except for the nat thingies, I'm not all to sure that would have been the answer. I did make all the iptables modules that do the natting, they loaded fine, but that didn't seem to do the trick.

After downgrading to iptables 1.2.8-r2 everything works great. If you are having probs with 1.2.9 I recommend giving this a try to solve things temporarily, if you're in a hurry :)

----------

## Kyrra

My answer the the "invlid arguement" problem with IPTables was this:

I was running version 1.2.8 of iptables, on the 2.4.20 kernel.  I was unable to build 1.2.9 under that kernel.  I was getting an error of some data element not existing in some data-structure that I'm imagining was from the kernel libraries.

After upgrading to 2.4.22, and rebooted, I got the "Invalid arguement" errors on all my nat rules.  So I emerged the 1.2.9, and rebooted.  Still the same error.

After rebuilding the kernel one more time, and rebooting it all worked fine.

----------

## puggy

Spam eradicated.  :Very Happy: 

Puggy

----------

## turumbar

I've been trying to setup iptables, but so far it still doesn't work.

I compile kernel 2.6 with everything under  

 *Quote:*   

> Device Drivers--->Networking Support--->Networking Options---->Network Packet Filtering (replace Ipchains)--->Netfilter Configuration 
> 
>  as modules.

 

I have tried compiling and recompilinad and emerge and reemergin iptables. but so far, nothing.

my /usr/src/linux points to the latest kernel (2.6.3-gentoo-r1), and that's the one I'm running and compiling (with genkernel all --menuconfig)

```
# lsmod |grep ipt

iptable_mangle          2432  0

ipt_LOG                 5504  0

ipt_MASQUERADE          4096  1

ipt_TOS                 2304  0

ipt_REDIRECT            2048  0

iptable_nat            27300  5 ip_nat_irc,ip_nat_ftp,ipt_MASQUERADE,ipt_REDIRECT

ipt_REJECT              5760  0

ip_conntrack           38700  7 ip_nat_irc,ip_nat_ftp,ipt_MASQUERADE,ipt_REDIRECT,iptable_nat,ip_conntrack_irc,ip_conntrack_ftp

ip_tables              19968  7 iptable_mangle,ipt_LOG,ipt_MASQUERADE,ipt_TOS,ipt_REDIRECT,iptable_nat,ipt_REJECT

```

but doing an

```
# iptables -X

iptables v1.2.9: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.
```

any suggestions?

thanks[/quote]

----------

## shawncorn

 *Quote:*   

> Well, i've finnaly complited my mission and it's time for me to relax and have a beer or two.
> 
> Hope anyone can find something usefull in this short story. 

 

Well, I've learned that you like to drink beers.  Personally I've never had a problem with iptables other than your standard PEBKAC.  ...Now that you mention it, I think I'd like to have a few beers too ;)

-Brian

----------

## Mousee

I've had the same probs as everyone else using the

2.4.25-gentoo-r2 kernel.

I followed this tutorial to the T, while still having these probs:

http://www.zaeratech.com/static/files/html/howtos/firewall_howto.shtml

Any help would be appreciated.

Thanks  :Smile: 

Would also like to note that the following lines caught my eye during

emerge of iptables..

 *Quote:*   

> 
> 
> >>> Source unpacked.
> 
> /bin/sh: line 1: extensions/.childlevel-test: Permission denied
> ...

 

I've never seen anything like that before...

EDIT::

I've also followed every other link pertainting to this, all of those

deal with older kernels however.. so is it possible this is a bug in the kernel?

I've gone as far as redownloading the sources and compiling from

scratch, to no avail as this error continues to show up no matter what:

 *Quote:*   

> 
> 
> /lib/modules/2.4.25-gentoo-r2/kernel/net/ipv4/netfilter/ip_tables.o: /lib/modules/2.4.25-gentoo-r2/kernel/net/ipv4/netfilter/ip_tables.o: unresolved symbol nf_register_sockopt_Rsmp_38d32eda
> 
> /lib/modules/2.4.25-gentoo-r2/kernel/net/ipv4/netfilter/ip_tables.o: /lib/modules/2.4.25-gentoo-r2/kernel/net/ipv4/netfilter/ip_tables.o: unresolved symbol nf_unregister_sockopt_Rsmp_b85617a1
> ...

 

I might try an older kernel now just to see if it's really a bug

or not in 2.4.25-r2.

----------

## crimsonphire

I am having the same probem as you, I am using kernel 2.4.25-gentoo-r2 and I emerge iptables and I get strange errors, but it still loads sortof, then I try to use forwarding rules:

================================================================================

#!/bin/sh

#

# rc.forward-2.6

FWVER=0.01

echo -e "\n\nLoading simple rc.forward version $FWVER..\n"

IPTABLES=/sbin/iptables

EXTIF="eth0"

INTIF="eth1"

echo "   External Interface:  $EXTIF"

echo "   Internal Interface:  $INTIF"

#CRITICAL:  Enable IP forwarding since it is disabled by default

echo "   enabling forwarding.."

echo "1" > /proc/sys/net/ipv4/ip_forward

# Dynamic IP users:

#

#   If you get your IP address dynamically from SLIP, PPP, or DHCP,

#   enable this following option.  This enables dynamic-address hacking

#   which makes the life with Diald and similar programs much easier.

#

# echo "   enabling DynamicAddr.."

# echo "1" > /proc/sys/net/ipv4/ip_dynaddr

# Enable simple IP forwarding and Masquerading

echo "   clearing any existing rules and setting default policy.."

$IPTABLES -P INPUT ACCEPT

$IPTABLES -F INPUT

$IPTABLES -P OUTPUT ACCEPT

$IPTABLES -F OUTPUT

$IPTABLES -P FORWARD DROP

$IPTABLES -F FORWARD

$IPTABLES -t nat -F

echo "   FWD: Allow all connections OUT and only existing and related ones IN"

$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT

$IPTABLES -A FORWARD -j LOG

echo "   Enabling SNAT (MASQUERADE) functionality on $EXTIF"

$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

echo -e "\nrc.forward v$FWVER done.\n"

===================================================================================

And I get this for output

===================================================================================

Loading simple rc.forward version 0.01..

   External Interface:  eth0

   Internal Interface:  eth1

   enabling forwarding..

   clearing any existing rules and setting default policy..

modprobe: Can't locate module ip_tables

iptables v1.2.9: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

modprobe: Can't locate module ip_tables

iptables v1.2.9: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

modprobe: Can't locate module ip_tables

iptables v1.2.9: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

modprobe: Can't locate module ip_tables

iptables v1.2.9: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

modprobe: Can't locate module ip_tables

iptables v1.2.9: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

modprobe: Can't locate module ip_tables

iptables v1.2.9: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

modprobe: Can't locate module ip_tables

iptables v1.2.9: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

   FWD: Allow all connections OUT and only existing and related ones IN

modprobe: Can't locate module ip_tables

iptables v1.2.9: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

modprobe: Can't locate module ip_tables

iptables v1.2.9: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

modprobe: Can't locate module ip_tables

iptables v1.2.9: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

   Enabling SNAT (MASQUERADE) functionality on eth0

modprobe: Can't locate module ip_tables

iptables v1.2.9: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

rc.forward v0.01 done.

==================================================================================

and yes I have patch-o-maticed my kernel and built tons of modules, all of them...  :Twisted Evil: 

I wish someone knew how to get this working...

----------

## Mousee

As kind of a follow up to this..

I decided to change over to vanilla-sources, and IPTables work

perfectly with all of the same settings I had in the gentoo-sources

kernel, so I'm going with it being a bug.

I like vanilla-sources now though so I'll stick with that, hehe  :Smile: 

I also got them working in the latest 2.6.6-rc1 kernel under

hardened-sources as well.

----------

## gilesc

I've re-emerged the kernel, iptables in every which order possible. I've upgraded kernels, I've done it all...

I still get the ridiculous, non-informative error message:

iptables: invalid argument

Is it possible that there is something fundamentally wrong with this ebuild??

 :Twisted Evil:  *GOING CRAZY*   :Crying or Very sad:  *sniff*

----------

## gilesc

Download iptables-1.2.9 source from http://www.netfilter.org

emerge --unmerge iptables

extract vanilla source

make

make install

yes... I'm going to blame the ebiuld on this one.

 :Laughing:   :Laughing:   :Laughing: 

----------

## dlambeth

I have never had a problem with iptables, and I've built more than 30 gentoo boxes. Must be an older kernel version your using.

----------

## drakos7

Heh. "older kernel".

gentoo-dev-sources 2.6.8-r1

When I try to modprobe ip_tables I get (like many others)

```
FATAL: Error inserting ip_tables (/lib/modules/2.6.8-gentoo-r1/kernel/net/ipv4/netfilter/ip_tables.ko): Unknown symbol in module, or unknown parameter (see dmesg)
```

 and dmesg

```
ip_tables: Unknown symbol nf_register_sockopt

ip_tables: Unknown symbol nf_unregister_sockopt
```

----------

## befa

pay attention to your iptables version! :Wink: 

----------

## Mr_Myaghi

THANK GOD!!!! er, I mean THANK ZEKY!!!!!!!!!!

Damn, been trying for the last three days nonstop to get the firewall working with another kernel version since gentoo-2.4.20 works crap with samba...been pulling my hair and hitting on pillows....didn't even think about upgrading iptables.   :Embarassed: 

Finally! Thanks again MATE!

----------

## Sjodahl

An me jsut geeting this error message....

Linux tmp # iptables -F

iptables v1.2.11: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

Linux tmp #

2.6.9-gentoo-r9

----------

## arckane

Using Kernel 2.6.10-r6 and with both the emerge version of iptables and the vanilla version from netfilters home page I'm getting

```

FATAL: Module ip_tables not found.

iptables v1.3.0rc1: can't initialize iptables table `nat': iptables who? (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

```

What gets me is that if I boot into my 2.4 kernel it works a charm  :Sad: 

----------

## kill

arckane you don't have required parts of iptables built into your kernel or as modules.

```

->Device Drivers

  ->Networking support

      ->Networking options

          [*]Network packet filtering (replaces ipchains) --->

               ->Ip: Netfilter Configuration

                    <*>Full NAT

```

----------

## arckane

Cheers Kill, don't I feel stupid now :lol

I didn't notice that it was a complete menu structure under there, so I just checked the Network Packet Filtering and carried on when I was compiling my kernel.  I suppose it was a case of not seeing the forest for the trees   :Confused: 

Thanks again

----------

## pppZero

```
blueDog ~ # iptables -L -v

FATAL: Module ip_tables not found.

iptables v1.3.0: can't initialize iptables table `filter': Invalid argument

Perhaps iptables or your kernel needs to be upgraded.
```

i've tried iptables-1.2.11-r3 as well. and kernel-2.6.11-rc2-mm2 and kernel-2.6.10-ac9.

i've emerged, unmerged, rebooted, built modules, built them in, built a bit of both, kicked, screamed, and generally have no idea whats going on.

I'm using .10-ac9 on another machine, where iptables works as expected, w/iptables-1.2.11

I checked the /usr/src/linux symlink, and its pointing to the right kernel.

can anyone suggest anything? i'd kinda like my firewall to get back to work, and i cant think of anything else  :Rolling Eyes: 

----------

## pratyeka

I had the same problem.  

Before finding the solution, I tried recompiling kernel, and re-emerging iptables, but neither succeeded.

What fixed the issue for me is the following.

 - I compiled netfilter NAT support (and everything else netfilter) HARD.  Before I had just the same selections, but they were modules.

Hope that helps you, my fellow gentoo users!

(Though I gotta say, I'm a bit upset that this damn issue made me reboot my box and lose my otherwise 201 day uptime!).   :Very Happy: 

----------

