# [SOLVED] iptables/netfilter module issues

## linuxwarz

I am new to Gentoo and have installed it according to the directions here: http://www.gentoo.org/doc/en/handbook/handbook-x86.xml

When I boot up for the first time after the installation, iptables will not load.

Error #1:

kakashi ipv4 # iptables --list

FATAL: Error inserting ip_tables (/lib/modules/2.6.25-gentoo-r7/kernel/net/ipv4/netfilter/ip_tables.ko): Unknown symbol in module, or unknown parameter (see dmesg)

iptables v1.4.0: can't initialize iptables table `filter': iptables who? (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

Error #2 (dmesg):

ip_tables: Unknown symbol nf_register_sockopt

ip_tables: Unknown symbol nf_unregister_sockopt

ip_tables: Unknown symbol nf_register_sockopt

ip_tables: Unknown symbol nf_unregister_sockopt

(repeated probably 50 times)

I have reinstalled Gentoo multiple times and have tried every possible kernel tweak I can think of and this wont work. My old distro was ubuntu-server and iptables worked just fine.

Searching for the solution on google did no good and I have yet to find someone who can give me a solution.

P.S: I am using the normal gentoo-sources kernel.

kakashi ~ # uname -a

Linux kakashi 2.6.25-gentoo-r7 #1 SMP Fri Aug 29 09:04:50 CDT 2008 i686 Intel(R) Celeron(R) CPU 1.70GHz GenuineIntel GNU/LinuxLast edited by linuxwarz on Sun Sep 07, 2008 4:15 pm; edited 1 time in total

----------

## ibins

you should at least enable the netfilter-xtables support:

make menuconfig -> Network -> Networking options -> Network packet filtering framework -> Core Netfilter Configuration  ---> Netfilter Xtables support (required for ip_tables)

depending on your need, you may require others too (IPv4 connection tracking support,...)

----------

## linuxwarz

 *ibins wrote:*   

> you should at least enable the netfilter-xtables support:
> 
> make menuconfig -> Network -> Networking options -> Network packet filtering framework -> Core Netfilter Configuration  ---> Netfilter Xtables support (required for ip_tables)
> 
> depending on your need, you may require others too (IPv4 connection tracking support,...)

 

This is my .config:

```

CONFIG_NETFILTER=y

CONFIG_NETFILTER_DEBUG=y

CONFIG_NETFILTER_ADVANCED=y

#

# Core Netfilter Configuration

#

CONFIG_NETFILTER_NETLINK=m

CONFIG_NETFILTER_NETLINK_QUEUE=m

CONFIG_NETFILTER_NETLINK_LOG=m

CONFIG_NF_CONNTRACK=m

CONFIG_NF_CT_ACCT=y

CONFIG_NF_CONNTRACK_MARK=y

CONFIG_NF_CONNTRACK_EVENTS=y

CONFIG_NF_CT_PROTO_GRE=m

CONFIG_NF_CT_PROTO_SCTP=m

CONFIG_NF_CT_PROTO_UDPLITE=m

CONFIG_NF_CONNTRACK_AMANDA=m

CONFIG_NF_CONNTRACK_FTP=m

CONFIG_NF_CONNTRACK_H323=m

CONFIG_NF_CONNTRACK_IRC=m

CONFIG_NF_CONNTRACK_NETBIOS_NS=m

CONFIG_NF_CONNTRACK_PPTP=m

CONFIG_NF_CONNTRACK_SANE=m

CONFIG_NF_CONNTRACK_SIP=m

CONFIG_NF_CONNTRACK_TFTP=m

CONFIG_NF_CT_NETLINK=m

CONFIG_NETFILTER_XTABLES=m

CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m

# CONFIG_NETFILTER_XT_TARGET_CONNMARK is not set

# CONFIG_NETFILTER_XT_TARGET_DSCP is not set

CONFIG_NETFILTER_XT_TARGET_MARK=m

CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m

CONFIG_NETFILTER_XT_TARGET_NFLOG=m

# CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set

CONFIG_NETFILTER_XT_TARGET_RATEEST=m

# CONFIG_NETFILTER_XT_TARGET_TRACE is not set

CONFIG_NETFILTER_XT_TARGET_TCPMSS=m

# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set

CONFIG_NETFILTER_XT_MATCH_COMMENT=m

CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m

CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m

CONFIG_NETFILTER_XT_MATCH_CONNMARK=m

CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m

CONFIG_NETFILTER_XT_MATCH_DCCP=m

CONFIG_NETFILTER_XT_MATCH_DSCP=m

CONFIG_NETFILTER_XT_MATCH_ESP=m

CONFIG_NETFILTER_XT_MATCH_HELPER=m

CONFIG_NETFILTER_XT_MATCH_IPRANGE=m

CONFIG_NETFILTER_XT_MATCH_LENGTH=m

CONFIG_NETFILTER_XT_MATCH_LIMIT=m

CONFIG_NETFILTER_XT_MATCH_MAC=m

CONFIG_NETFILTER_XT_MATCH_MARK=m

CONFIG_NETFILTER_XT_MATCH_OWNER=m

CONFIG_NETFILTER_XT_MATCH_POLICY=m

CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m

CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m

CONFIG_NETFILTER_XT_MATCH_QUOTA=m

CONFIG_NETFILTER_XT_MATCH_RATEEST=m

CONFIG_NETFILTER_XT_MATCH_REALM=m

CONFIG_NETFILTER_XT_MATCH_SCTP=m

CONFIG_NETFILTER_XT_MATCH_STATE=m

CONFIG_NETFILTER_XT_MATCH_STATISTIC=m

CONFIG_NETFILTER_XT_MATCH_STRING=m

CONFIG_NETFILTER_XT_MATCH_TCPMSS=m

CONFIG_NETFILTER_XT_MATCH_TIME=m

CONFIG_NETFILTER_XT_MATCH_U32=m

CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m

#

# IP: Netfilter Configuration

#

CONFIG_NF_CONNTRACK_IPV4=m

CONFIG_NF_CONNTRACK_PROC_COMPAT=y

CONFIG_IP_NF_QUEUE=m

CONFIG_IP_NF_IPTABLES=m

CONFIG_IP_NF_MATCH_RECENT=m

CONFIG_IP_NF_MATCH_ECN=m

CONFIG_IP_NF_MATCH_AH=m

CONFIG_IP_NF_MATCH_TTL=m

CONFIG_IP_NF_MATCH_ADDRTYPE=m

CONFIG_IP_NF_FILTER=m

CONFIG_IP_NF_TARGET_REJECT=m

CONFIG_IP_NF_TARGET_LOG=m

CONFIG_IP_NF_TARGET_ULOG=m

CONFIG_NF_NAT=m

CONFIG_NF_NAT_NEEDED=y

CONFIG_IP_NF_TARGET_MASQUERADE=m

CONFIG_IP_NF_TARGET_REDIRECT=m

CONFIG_IP_NF_TARGET_NETMAP=m

CONFIG_NF_NAT_SNMP_BASIC=m

CONFIG_NF_NAT_PROTO_GRE=m

CONFIG_NF_NAT_FTP=m

CONFIG_NF_NAT_IRC=m

CONFIG_NF_NAT_TFTP=m

CONFIG_NF_NAT_AMANDA=m

CONFIG_NF_NAT_H323=m

CONFIG_NF_NAT_SIP=m

CONFIG_IP_NF_MANGLE=m

CONFIG_IP_NF_TARGET_ECN=m

CONFIG_IP_NF_TARGET_TTL=m

CONFIG_IP_NF_TARGET_CLUSTERIP=m

CONFIG_IP_NF_RAW=m

CONFIG_IP_NF_ARPTABLES=m

CONFIG_IP_NF_ARPFILTER=m

CONFIG_IP_NF_ARP_MANGLE=m

#

# IPv6: Netfilter Configuration

#

CONFIG_NF_CONNTRACK_IPV6=m

CONFIG_IP6_NF_QUEUE=m

CONFIG_IP6_NF_IPTABLES=m

CONFIG_IP6_NF_MATCH_RT=m

CONFIG_IP6_NF_MATCH_OPTS=m

CONFIG_IP6_NF_MATCH_FRAG=m

CONFIG_IP6_NF_MATCH_HL=m

CONFIG_IP6_NF_MATCH_IPV6HEADER=m

CONFIG_IP6_NF_MATCH_AH=m

CONFIG_IP6_NF_MATCH_MH=m

CONFIG_IP6_NF_MATCH_EUI64=m

CONFIG_IP6_NF_FILTER=m

CONFIG_IP6_NF_TARGET_LOG=m

CONFIG_IP6_NF_TARGET_REJECT=m

CONFIG_IP6_NF_MANGLE=m

CONFIG_IP6_NF_TARGET_HL=m

CONFIG_IP6_NF_RAW=m

CONFIG_VLAN_8021Q=y

CONFIG_WAN_ROUTER=y

CONFIG_NET_SCHED=y

```

Compiling all of it as static instead of modular still results in a broken iptables.

----------

## linuxwarz

/bump

The livecd installer resulted in iptables working, but I noticed it was kernel version 2.6.24 and I believe -r5. I would rather use the min install cd to reduce bloat, so does anyone have any suggestions as to why it is not working, or even what steps I should take to install gentoo that the guide might not be telling me?

----------

## ibins

there are only a view packages involved in this issue: kernel, iptables, the linux-headers required to build iptables and glibc of course. So I think the problem lies in the kernel configuration.

btw is CONFIG_KMOD enabled ?

you could try to manually load the netfilter modules:

```

modprobe x_tables

```

afterwards you can test if the module has been loaded using the command:

```

lsmod | grep x_tables

```

if not, you will find error messages using 

```

dmesg

```

other important netfilter modules are: ipt_addrtype,xt_tcpudp,ip_tables

----------

## linuxwarz

iptables module loads when I execute the others first. And to answer your other question, CONFIG_KMOD is not set. I will recompile it tomorrow morning and repost.

 *Quote:*   

> 
> 
> Module                  Size  Used by
> 
> ip_tables              13456  0
> ...

 

----------

## linuxwarz

CONFIG_KMOD does not work, I still have the same issues regardless if it is set or not.

[EDIT]

I compiled a new kernel from kernel.org and compiled a fresh iptables from netfilters website and the module loads without error, BUT not automatic. So I still have a problem to fix because I don't want to load all of these modules when they should be automatic (at least to my knowledge). I have to load iptable_nat iptable_filter iptable_mangle etc by hand. Any suggestions?

 *Quote:*   

> 
> 
> kakashi modules # modprobe iptable_filter
> 
> kakashi modules # iptables --list
> ...

 

 *Quote:*   

> 
> 
> kakashi modules # uname -a
> 
> Linux kakashi 2.6.26.3 #1 SMP Fri Sep 5 08:14:49 CDT 2008 i686 Intel(R) Celeron(R) CPU 1.70GHz GenuineIntel GNU/Linux
> ...

 

 *Quote:*   

> 
> 
> kakashi modules # iptables --version
> 
> iptables v1.4.2-rc1
> ...

 

[EDIT 2]

Realized CONFIG_KMOD did not get set in this new kernel when I thought it was. Recompiling.

[EDIT 3]

After enabling this option, iptables broke again.

----------

## linuxwarz

Solved. /boot was not writable, so when I went to recompile the kernel and replace the boot image, it would keep the old kernel image resulting in a broken system.

----------

