# [SOLVED] Problem with iptables after kernel upgrade

## peka

After I've upgraded my kernel to 2.6.16 from 2.6.15, iptables stopped working

```
genio linux # /etc/init.d/iptables restart

 * Re-caching dependency info (mtimes differ)...

 * Re-caching dependency info (mtimes differ)...

 * Re-caching dependency info (mtimes differ)...

 * Re-caching dependency info (mtimes differ)...

 * Loading iptables state and starting firewall ...

FATAL: Module ip_tables not found.

iptables-restore v1.3.4: iptables-restore: unable to initializetable 'nat'

Error occurred at line: 2

Try `iptables-restore -h' or 'iptables-restore --help' for more information.                                   [ !! ]
```

There has been some changes around networking set up in kernel config. I've tried to set it uo and working but no success.

----------

## dgaffuri

Check that you've built the ip_tables module

```
# modprobe -l | grep ip_tables

/lib/modules/2.6.17-rc3/kernel/net/ipv4/netfilter/ip_tables.ko
```

If so, check errors in dmesg while trying to modprobe it.

----------

## peka

Nope, the module's not there. Seems like I have not built it.

Where is it in 2.6.16 kernel config?

I did this:

```
  │ │ [*] Network packet filtering (replaces ipchains)  --->                                  │ │
```

```

  │ │ < > Netfilter netlink interface                                                         │ │

  │ │ <*> Netfilter Xtables support (required for ip_tables)                                  │ │

  │ │ < >   "CLASSIFY" target support                                                         │ │

  │ │ < >   "MARK" target support                                                             │ │

  │ │ < >   "NFQUEUE" target Support                                                          │ │

  │ │ < >   "comment" match support                                                           │ │

  │ │ <*>   "conntrack" connection tracking match support                                     │ │

  │ │ < >   "DCCP" protocol match support                                                     │ │

  │ │ < >   "helper" match support                                                            │ │

  │ │ < >   "length" match support                                                            │ │

  │ │ < >   "limit" match support                                                             │ │

  │ │ < >   "mac" address match support                                                       │ │

  │ │ < >   "mark" match support                                                              │ │

  │ │ < >   "pkttype" packet type match support                                               │ │

  │ │ < >   "realm" match support                                                             │ │

  │ │ < >   "sctp" protocol match support                                                     │ │

  │ │ <*>   "state" match support                                                             │ │

  │ │ < >   "string" match support                                                            │ │

  │ │ < >   "tcpmss" match support                                                            │ │
```

```
  │ │ <*> Connection tracking (required for masq/NAT)                                         │ │

  │ │ [ ]   Connection tracking flow accounting                                               │ │

  │ │ [ ]   Connection mark tracking support                                                  │ │

  │ │ [ ]   Connection tracking events (EXPERIMENTAL)                                         │ │

  │ │ < >   SCTP protocol connection tracking support (EXPERIMENTAL)                          │ │

  │ │ <*>   FTP protocol support                                                              │ │

  │ │ < >   IRC protocol support                                                              │ │

  │ │ < >   NetBIOS name service protocol support (EXPERIMENTAL)                              │ │

  │ │ < >   TFTP protocol support                                                             │ │

  │ │ < >   Amanda backup protocol support                                                    │ │

  │ │ < >   PPTP protocol support                                                             │ │

  │ │ < > IP Userspace queueing via NETLINK (OBSOLETE)                                        │ │

  │ │ <*> IP tables support (required for filtering/masq/NAT)                                 │ │

  │ │ < >   IP range match support                                                            │ │

  │ │ < >   Multiple port match support                                                       │ │

  │ │ < >   TOS match support                                                                 │ │

  │ │ < >   recent match support                                                              │ │

  │ │ < >   ECN match support                                                                 │ │

  │ │ < >   DSCP match support                                                                │ │

  │ │ < >   AH/ESP match support                                                              │ │

  │ │ < >   TTL match support                                                                 │ │

  │ │ < >   Owner match support                                                               │ │

  │ │ < >   address type match support                                                        │ │

  │ │ < >   hashlimit match support                                                           │ │

  │ │ < >   Packet filtering                                                                  │ │

  │ │ < >   LOG target support                                                                │ │

  │ │ < >   ULOG target support (OBSOLETE)                                                    │ │

  │ │ < >   TCPMSS target support                                                             │ │

  │ │ < >   Full NAT                                                                          │ │

  │ │ < >   Packet mangling                                                                   │ │

  │ │ < >   raw table support (required for NOTRACK/TRACE)                                    │ │
```

----------

## dgaffuri

```
 Symbol: IP_NF_IPTABLES [=m]

 Prompt: IP tables support (required for filtering/masq/NAT)

   Defined at net/ipv4/netfilter/Kconfig:183

   Depends on: NET && INET && NETFILTER && NETFILTER_XTABLES

   Location:

     -> Networking

       -> Networking support (NET [=y])

         -> Networking options

           -> Network packet filtering (replaces ipchains) (NETFILTER [=y])

             -> IP: Netfilter Configuration
```

----------

## peka

Is it possible that compiling it in kernel as opposed to compiling as a module causes this problem?

----------

## dgaffuri

For sure you'll not be able to modprobe the module and you'll not see it with modprobe -l. I think it should work, but I've never tried. Maybe you're missing some other option. E.g. if you're using NAT you'll need ip_nat module too (CONFIG_IP_NF_NAT=m), and ip_conntrack for connection tracking (CONFIG_IP_NF_CONNTRACK=m). And if you use state matches xt_state.ko (CONFIG_NETFILTER_XT_MATCH_STATE=m).

----------

## zietbukuel

I have this problem too, and I have built the module correctly, but iptables is not working. I ve updated my kernel from 2.6.14 to 2.6.16.

I have this:

```
# modprobe -l | grep ip_tables

/lib/modules/2.6.16-gentoo-r7/kernel/net/ipv4/netfilter/ip_tables.ko

```

When I so:

```
service iptables start

 * Service iptables starting

iptables-restore v1.3.5: iptables-restore: unable to initializetable 'mangle'

Error occurred at line: 2

Try `iptables-restore -h' or 'iptables-restore --help' for more informat  [ !! ] * ERROR:  iptables failed to start
```

PS. I'm using some script a la redhat to start/stop my services   :Very Happy: 

----------

## dgaffuri

Check for CONFIG_IP_NF_MANGLE in kernel configuration.

----------

## zietbukuel

 *dgaffuri wrote:*   

> Check for CONFIG_IP_NF_MANGLE in kernel configuration.

 

Where can I find it in menuconfig? thanks.

EDIT: Nevermind, found it, thank you very much  :Very Happy: 

----------

## dgaffuri

You may press "/" followed by the symbol (without the CONFIG_ prefix) to find an option in menuconfig.

----------

## zietbukuel

 *dgaffuri wrote:*   

> You may press "/" followed by the symbol (without the CONFIG_ prefix) to find an option in menuconfig.

 

Didn't knew that, thanks!   :Wink: 

----------

## peka

I worked out nat but now I get folter missing:

```
genio linux # /etc/init.d/iptables start

 * Loading iptables state and starting firewall ...

FATAL: Module ip_tables not found.

iptables-restore v1.3.4: iptables-restore: unable to initializetable 'filter'
```

```
genio linux # grep -i filter .config

CONFIG_NETFILTER=y

# CONFIG_NETFILTER_DEBUG is not set

# Core Netfilter Configuration

# CONFIG_NETFILTER_NETLINK is not set

CONFIG_NETFILTER_XTABLES=y

# CONFIG_NETFILTER_XT_TARGET_CLASSIFY is not set

# CONFIG_NETFILTER_XT_TARGET_MARK is not set

# CONFIG_NETFILTER_XT_TARGET_NFQUEUE is not set

# CONFIG_NETFILTER_XT_MATCH_COMMENT is not set

CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y

# CONFIG_NETFILTER_XT_MATCH_DCCP is not set

# CONFIG_NETFILTER_XT_MATCH_HELPER is not set

# CONFIG_NETFILTER_XT_MATCH_LENGTH is not set

# CONFIG_NETFILTER_XT_MATCH_LIMIT is not set

# CONFIG_NETFILTER_XT_MATCH_MAC is not set

# CONFIG_NETFILTER_XT_MATCH_MARK is not set

# CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set

# CONFIG_NETFILTER_XT_MATCH_REALM is not set

# CONFIG_NETFILTER_XT_MATCH_SCTP is not set

CONFIG_NETFILTER_XT_MATCH_STATE=y

# CONFIG_NETFILTER_XT_MATCH_STRING is not set

# CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set

# IP: Netfilter Configuration

CONFIG_IP_NF_FILTER=y

# IPv6: Netfilter Configuration (EXPERIMENTAL)

# CONFIG_ATM_BR2684_IPFILTER is not set

# CONFIG_PPP_FILTER is not set

```

----------

## peka

Duh... $#%#@$^%@#$%!

I was missing this option: <*> Netfilter netlink interface

----------

