# Kernel is blocked when I configure it for iptables support

## jmbargar

Hello:

I want to run iptables so I configure and compile my kernel 2.6.19-gentoo-r5 for iptables support and I reboot my computer. After that, I run gdm and login in my account. When gnome is running the system is blocked and I don't know why. I have change the next options in my kernel:

Networking  ---->

 Networking options  ---->

  Network Packet Filtering (replaces Ipchains)--->

   Core Netfilter Configuration ---->

    ["enable"] Netfilter Xtables support (required for ip_tables)

    ["enable"] Netfilter Xtables_Match_State, most firewall scripts use state...including the sample here.

   IP: Netfilter Configuration --->

    ["enable"] IP tables support (required for filtering/masq/NAT)

    ["enable"] Packet Filtering

I have try to configure it loading the corresponding modules, doing:

echo "ip_tables" >> /etc/modules.autoload.d/kernel-2.6 

echo "iptable_filter" >> /etc/modules.autoload.d/kernel-2.6

modules-update

and the system is blocked but if I compile this options built-in the kernel the system is blocked too.

I use genkernel to compile the kernel doing:

genkernel --menuconfig all

Thank you for helping me. Bye.

----------

## didymos

What do you mean by "blocked"?

----------

## jmbargar

When my system is blocked I can't use my mouse and I can't use my keyboard. In this situation my computer gave up working and the image in my screen turn static.

----------

## didymos

Did you change anything else besides iptables?  I don't see how these modules would affect Gnome.  Does everything work if you don't load the iptables modules?

----------

## Ma3oxuct

jmbargar: Did you recompile a kernel that you were using before, or was this a fresh compilation?

Are you using nvidia drivers or ati drivers?

Check your /var/log/Xorg.0.log...

----------

## jmbargar

First of all thanks for your answers  :Smile: 

didymos:

Only I have change the options in my kernel configuration that I describe in my first post. I think this changes produces a kernel blocked not a Gnome blocked because all my system give up answering. For example, my keyboard doesn't answer, in fact not even if I want to turn off the Num Lock light.

If I don't select the iptables support in my kernel that I have indicated before, everything work fine.

It happens if I compile it like a module, but if I comile it built-in the kernel it happens too.

I have to say that my system doesn't give up working immediately, I can work during three or five minutes and after this time my system give up working.

Ma3oxuct:

I recompiled the kernel that I was using before with the iptables support.

I have using nvidia drivers, in fact my system is similar to yours, I use:

Athlon64 X2 4600+

Asus M2N-SLI Deluxe

Nvidia GeForce 7300 GS

I have checked my Xlog file but I have found nothing wrong. I you want to see it I can send a mail with the file attached because I consider it's too large for posting here.

----------

## didymos

Anything in /var/log/messages? You might consider updating to a newer gentoo-sources and see if the problem persists.

----------

## didymos

Oh, yeah, what kind of network adapter do you have?  Also, you don't need to add the iptables modules to /etc/modules.autoload.d/kernel-2.6. Just add the iptables service to the default runlevel and it'll handle all the module loading.

----------

## jmbargar

I have checked my /var/log/messages and I can find nothing wrong. If you want to see it, I can send you an email with this file attached. Of course, I would send you only a part of this file in which you could see a session with the problem that I describe in this post.

On the other hand, I am already using the last stable release of gentoo-sources for amd64 (2.6.19-r5) and my network adapter is integrated in the mainboard. Here is the output of "lspci | grep Ethernet":

00:08.0 Bridge: nVidia Corporation MCP55 Ethernet (rev a2)

00:09.0 Bridge: nVidia Corporation MCP55 Ethernet (rev a2)

Thank you to notice me that if I add the iptables service to the default runlevel, it'll handle all the module loading. I didn't know  :Smile: 

----------

## didymos

Yeah, the startup services should have some sort of central documentation. For the most part, I think they're all documented, but scattered throughout other docs.  It's a good idea to just do "ls /etc/conf.d/" every now and then to see if anything new has appeared. I can't recall what specifically it was at the moment, but there was something I was handling myself ad-hoc, and it turned out there was a service for it already configured properly.

As to the lock-ups, I'm stymied at the moment. Trying a 2.6.20 kernel is still the only thing I can think of.

----------

## jmbargar

Ok, I will try with another kernel although it was not a stable release and I will tell you. It's curious that the system is stopped although I had not installed iptables, it's enough to compile the kernel with iptables support to give up working.

Thanks for your help!  :Smile: 

----------

## jmbargar

Hello again:

I thought that perhaps I could try to configure my kernel without using --menuconfig in the genkernel options. So I found a gentoo website where described the kernel configuration for iptables support as the follow:

CONFIG_NETFILTER=y

CONFIG_IP_NF_CONNTRACK=y

CONFIG_IP_NF_IPTABLES=y

CONFIG_IP_NF_MATCH_STATE=y

CONFIG_IP_NF_FILTER=y

CONFIG_IP_NF_TARGET_REJECT=y

CONFIG_IP_NF_NAT=y

CONFIG_IP_NF_NAT_NEEDED=y

CONFIG_IP_NF_TARGET_MASQUERADE=y

CONFIG_IP_NF_TARGET_LOG=y

So, I modified my /usr/src/linux/.config file with this options and I ran "genkernel all" but I could see this tool modified the .config file to the original status. I suppose it could be done by the genkernel tool because I had not modified the /usr/src/linux/.config.old and /usr/src/linux/.config.bak so I had the changes in these files too but the result was the same, genkernel modified the three files to the original status and compiled my kernel without the options that I wanted. Do you know a method to configure my kernel in this way? Perhaps it works!  :Smile: 

----------

## didymos

I don't ever bother with genkernel.  It's really only useful for automating initrd/initramfs stuff, as I see it.  Just cd to /usr/src/linux, then run make menuconfig.  When you've gotten all that done all you need to do to use the new kernel is:

```

make && make install && make modules_install

```

The only snag, really, is if you're building another kernel with the same exact version. They'll both install modules to the same directory, unless you back up the modules. Anyway, that command above will handle the bootloader for you, and it'll back up the old kernel.  

Also, if all you're doing is building new modules (and not switching anything from built-in to module or changing anything else), all you need to do is:

```

make modules && make modules_install

```

Then, you can use the new modules immediately without a reboot or having to build the entire kernel over again.

----------

## jmbargar

I have done all you said me but I have a couple of questions. With this method:

```
make && make install && make modules_install
```

I have built a kernel that I can use including some lines in the /boot/grub/menu.lst file, but when I configured Grub I had not initrd file to write in menu.lst, only I had the kernel that I built. The system works without initrd but it doesn't load some modules and services (for example, my network or the ieee1394 support) do you know which could be the reason?

I am using Gentoo two or three months ago. I used Ubuntu before, but I wanted to learn more about Linux and I consider that Ubuntu is too easy to allow it. Really this is the first time that I compile a kernel with make. When I began with Gentoo I decided to use Genkernel to have a more easy contact with a compilation method. Ubuntu use initrd in all its version that I have used to boot the system and this is the first time I boot a system without initrd, but now I have booted without initrd I ask me what is the initrd function?

Thanks for all you are helping me  :Smile: 

----------

## didymos

Well, if the system boots, you don't need the initrd, unless you want to do splash screens.  What you want to do to get modules loaded during startup is add their names to the file /etc/modules.autoload.d/kernel-2.6.  That should fix things so the services startup correctly.

----------

## jmbargar

So, the initrd file is only necessary for splashing screen or has it another function related with booting the system? If I use the splash=silent option in the /boot/grub/menu.lst I can boot my system with a splash screen too and I don´t need initrd for doing it, but I am not sure if it´s that you have referred when you have said I need the initrd for splashing screen...  :Smile:  Really I am not clear what is initrd used for.

If I have to add some modules to /etc/modules.autoload.d/kernel-2.6 for loading at startup, how could I know the names of the corresponding modules? For example, if I want to load the network module I suppose I should have to add some module called "net" or similar in /etc/modules.autoload.d/kernel-2.6 but can I know which is the real name of the module?

----------

## didymos

Well, for splash, the initrd allows the splash screen to start much earlier. Basically, a couple seconds after the kernel first starts to load. Otherwise you have to wait for the root filesystem to mount.  The other big use for an initrd is if you built a driver as a module and the system can't boot unless that module is loaded.

----------

## jmbargar

So, initrd is used for starting earlier and loading modules to boot the system (for example a sata module), isn´t it?

I remember when I compile my second kernel (powered by genkernel   :Very Happy:  ) that my system could not boot because it doesn´t recognized the sata disk, so I had to enable the sata options built-in the kernel and all worked fine. I suppose my first kernel compiled with the first instalation (powered by genkernel as well) could boot because the sata support was enabled by initrd, so how could I configure initrd for loading the sata modules? I have read something about a command called mkinitrd but I am not sure if it´s used for configuring the initrd in the way I want.

If I have to add some modules to /etc/modules.autoload.d/kernel-2.6 for loading at startup as you have said me in your last post, how could I know the names of the corresponding modules? For example, if I want to load the network module I suppose I should have to add some module called "net" or similar in /etc/modules.autoload.d/kernel-2.6 but can I know which is the real name of the module?

----------

