# l7-filter-userspace: NFNETLINK Device or resource busy

## Darknight

I followed the tutorial at http://l7-filter.sourceforge.net/HOWTO-userspace but I can't make it work :/

The rule (just for test purposes) in my firewall script is: iptables -A FORWARD -j NFQUEUE --queue-num 10

After I run the script:

```
phantom ~ # l7-filter -f /etc/l7-filter.conf -vvvv -q 10

Failed to open /proc/modules, can't check for required kernel features.

Failed to open /proc/modules, can't check for required kernel features.

                      ***WARNING***

Neither the ip_conntrack_netlink nor nf_conntrack_netlink kernel

modules are loaded. Unless these features are compiled into your

kernel, please load one and run l7-filter again.

Failed to open /proc/modules, can't check for required kernel features.

Failed to open /proc/modules, can't check for required kernel features.

                      ***WARNING***

Neither the ip_conntrack_ipv4 nor nf_conntrack_ipv4 kernel modules

are loaded.  Unless these features are compiled into your kernel,

please load one and run l7-filter again.

Attempting to read configuration from /etc/l7-filter.conf

Attempting to load pattern from /etc/l7-protocols/protocols/edonkey.pat

pattern='^[\xc5\xd4\xe3-\xe5].?.?.?.?([\x01\x02\x05\x14\x15\x16\x18\x19\x1a\x1b\x1c\x20\x21\x32\x33\x34\x35\x36\x38\x40\x41\x42\x43\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58[\x60\x81\x82\x90\x91\x93\x96\x97\x98\x99\x9a\x9b\x9c\x9e\xa0\xa1\xa2\xa3\xa4]|\x59................?[ -~]|\x96....$)'

eflags=0 cflags=11

Added: edonkey  mark=10

Attempting to load pattern from /etc/l7-protocols/protocols/ssh.pat

pattern='^ssh-[12]\.[0-9]'

eflags=0 cflags=11

Added: ssh      mark=11

opening library handle

unbinding existing nf_queue handler for AF_INET (if any)

NFNETLINK answers: Invalid argument

binding nfnetlink_queue as nf_queue handler for AF_INET

NFNETLINK answers: Device or resource busy

error during nfq_bind_pf()
```

I tried the default port 0, then a few others but it didn't make a difference.

Is there something wrong with my kernel config?

```
phantom ~ # grep -i "conntrack\|netlink" /usr/src/linux/.config

CONFIG_NETFILTER_NETLINK=y

CONFIG_NETFILTER_NETLINK_QUEUE=y

# CONFIG_NETFILTER_NETLINK_LOG is not set

CONFIG_NF_CONNTRACK=y

CONFIG_NF_CONNTRACK_MARK=y

# CONFIG_NF_CONNTRACK_EVENTS is not set

# CONFIG_NF_CONNTRACK_AMANDA is not set

CONFIG_NF_CONNTRACK_FTP=y

CONFIG_NF_CONNTRACK_H323=y

CONFIG_NF_CONNTRACK_IRC=y

# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set

# CONFIG_NF_CONNTRACK_PPTP is not set

# CONFIG_NF_CONNTRACK_SANE is not set

CONFIG_NF_CONNTRACK_SIP=y

# CONFIG_NF_CONNTRACK_TFTP is not set

CONFIG_NF_CT_NETLINK=y

CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y

CONFIG_NF_CONNTRACK_IPV4=y

CONFIG_NF_CONNTRACK_PROC_COMPAT=y

CONFIG_SCSI_NETLINK=y
```

Or with my packages?

```
phantom ~ # equery l l7

[ Searching for package 'l7' in all categories among: ]

 * installed packages

[I--] [ ~] net-misc/l7-filter-userspace-0.10 (0)

[I--] [ ~] net-misc/l7-protocols-2008.12.18 (0)

phantom ~ # equery l iptables

[ Searching for package 'iptables' in all categories among: ]

 * installed packages

[I--] [  ] net-firewall/iptables-1.4.0-r1 (0)

phantom ~ # emerge -pv iptables

[ebuild   R   ] net-firewall/iptables-1.4.0-r1  USE="-extensions -imq -ipv6 -l7filter -static" 0 kB

```

Maybe I miss something obvious, I'm very tired right now.

Thanks in advance.

----------

