# iptables v1.8.2 (legacy): can't initialize iptables table

## samuelbernardo

Hi,

Today after gentoo upgrade I realize that libvirt have an error in the startup. Iptables are not working as expected and because of that libvirt can't set the forward rules for nat bridges.

The related ebuilds I've installed are:

net-firewall/iptables-1.8.2-r2 conntrack ipv6 netlink pcap -nftables

net-firewall/nftables-0.9.0-r4 gmp json modern_kernel readline

net-firewall/ebtables-2.0.10.4 +perl

app-emulation/libvirt-5.1.0 caps dbus fuse libvirtd lvm lxc macvtap nfs nls parted policykit qemu sasl udev vepa virt-network wireshark-plugins zfs

sys-kernel/gentoo-sources-4.19.34 experimental

I've iptables enabled with almost all other options:

grep NF_IPTABLES /boot/config-$(uname -r)

CONFIG_IP_NF_IPTABLES=y

CONFIG_IP6_NF_IPTABLES=y

I've also enable ebtables and nftables related options in kernel.

nft commands work without any problem, such as ebtables. Only iptables have this error.

I can't enable use flag nftables in iptables ebuild because libvirt requires iptables with nftables flag disabled.

Does anyone have an hint for the reason why the following error happens?

```

# iptables -nvL

iptables v1.8.2 (legacy): can't initialize iptables table `filter': No child processes                                                 

Perhaps iptables or your kernel needs to be upgraded.

```

Conplete kernel configuration: https://pastebin.com/TDpwKij0

```

# cat /proc/net/ip_tables_names

security

raw

nat

mangle

filter

```

Thanks

----------

## deagol

You probably missing some kernel module(s)

I had the exactly same error message today after updating my kernel. I used the old kernel config as base and with the new kernel I got the same error. 

If I'm right booting your old kernel will allow iptables to work again.

You then have to figure out exactly what's missing... In my case MASQUERADE target was missing. A master option was off, MASQUERADE was one of selectable targets.

Doesn't look like that's your problem, though... 

But when you can confirm that it's still working with the old kernel something next to sure is...

----------

## samuelbernardo

 *deagol wrote:*   

> You probably missing some kernel module(s)
> 
> I had the exactly same error message today after updating my kernel. I used the old kernel config as base and with the new kernel I got the same error. 
> 
> If I'm right booting your old kernel will allow iptables to work again.
> ...

 

Thanks for your feedback.

Unfortunately I have already MASQUERADE target enabled.

I have an hint that the problem maybe related to iptables nftables flag that I can't activate because libvirt and lxd still depend on ebtables that brings a conflict to iptables with nftables.

So my firewall now is being configured by nft that is working as expected. libvirtd gives warnings when starting because of iptables command errors, but is still working.

My hope now is libvirt and lxd start to support nftables.

----------

## samuelbernardo

Installing net-firewall/ebtables-2.0.10.4-r2 allows to install iptables with nftables use flag. With this is possible to have linux kernel with nftables enabled.

----------

## alamahant

Then ditch nftables and use iptables instead.

Not only libvirt,even firewalld,docker etc do not work properly with nftables yet.

Firewalld gives you the option to choose iptables or nftables backend in firewalld.conf file.

It will take time so just stick with iptables instead.

Use these flags for them to be fully functional:

First remove anything "netfilter" from your kernel .config file thus:

```

sed -i '/NETFILTER/d' /usr/src/linux/.config

```

and then you need to append the following and recompile:

```

CONFIG_NETFILTER=y

CONFIG_NETFILTER_ADVANCED=y

CONFIG_BRIDGE_NETFILTER=y

# Core Netfilter Configuration

CONFIG_NETFILTER_INGRESS=y

CONFIG_NETFILTER_NETLINK=m

CONFIG_NETFILTER_FAMILY_BRIDGE=y

CONFIG_NETFILTER_FAMILY_ARP=y

CONFIG_NETFILTER_NETLINK_ACCT=m

CONFIG_NETFILTER_NETLINK_QUEUE=m

CONFIG_NETFILTER_NETLINK_LOG=m

CONFIG_NETFILTER_NETLINK_OSF=m

CONFIG_NETFILTER_CONNCOUNT=m

CONFIG_NETFILTER_NETLINK_GLUE_CT=y

CONFIG_NETFILTER_SYNPROXY=m

CONFIG_NETFILTER_XTABLES=y

CONFIG_NETFILTER_XT_MARK=m

CONFIG_NETFILTER_XT_CONNMARK=m

CONFIG_NETFILTER_XT_SET=m

CONFIG_NETFILTER_XT_TARGET_AUDIT=m

CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m

CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m

CONFIG_NETFILTER_XT_TARGET_CONNMARK=m

CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m

CONFIG_NETFILTER_XT_TARGET_CT=m

CONFIG_NETFILTER_XT_TARGET_DSCP=m

CONFIG_NETFILTER_XT_TARGET_HL=m

CONFIG_NETFILTER_XT_TARGET_HMARK=m

CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m

CONFIG_NETFILTER_XT_TARGET_LED=m

CONFIG_NETFILTER_XT_TARGET_LOG=m

CONFIG_NETFILTER_XT_TARGET_MARK=m

CONFIG_NETFILTER_XT_NAT=m

CONFIG_NETFILTER_XT_TARGET_NETMAP=m

CONFIG_NETFILTER_XT_TARGET_NFLOG=m

CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m

CONFIG_NETFILTER_XT_TARGET_NOTRACK=m

CONFIG_NETFILTER_XT_TARGET_RATEEST=m

CONFIG_NETFILTER_XT_TARGET_REDIRECT=m

CONFIG_NETFILTER_XT_TARGET_TEE=m

CONFIG_NETFILTER_XT_TARGET_TPROXY=m

CONFIG_NETFILTER_XT_TARGET_TRACE=m

CONFIG_NETFILTER_XT_TARGET_SECMARK=m

CONFIG_NETFILTER_XT_TARGET_TCPMSS=m

CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m

CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m

CONFIG_NETFILTER_XT_MATCH_BPF=m

CONFIG_NETFILTER_XT_MATCH_CGROUP=m

CONFIG_NETFILTER_XT_MATCH_CLUSTER=m

CONFIG_NETFILTER_XT_MATCH_COMMENT=m

CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m

CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m

CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m

CONFIG_NETFILTER_XT_MATCH_CONNMARK=m

CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m

CONFIG_NETFILTER_XT_MATCH_CPU=m

CONFIG_NETFILTER_XT_MATCH_DCCP=m

CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m

CONFIG_NETFILTER_XT_MATCH_DSCP=m

CONFIG_NETFILTER_XT_MATCH_ECN=m

CONFIG_NETFILTER_XT_MATCH_ESP=m

CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m

CONFIG_NETFILTER_XT_MATCH_HELPER=m

CONFIG_NETFILTER_XT_MATCH_HL=m

CONFIG_NETFILTER_XT_MATCH_IPCOMP=m

CONFIG_NETFILTER_XT_MATCH_IPRANGE=m

CONFIG_NETFILTER_XT_MATCH_IPVS=m

CONFIG_NETFILTER_XT_MATCH_L2TP=m

CONFIG_NETFILTER_XT_MATCH_LENGTH=m

CONFIG_NETFILTER_XT_MATCH_LIMIT=m

CONFIG_NETFILTER_XT_MATCH_MAC=m

CONFIG_NETFILTER_XT_MATCH_MARK=m

CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m

CONFIG_NETFILTER_XT_MATCH_NFACCT=m

CONFIG_NETFILTER_XT_MATCH_OSF=m

CONFIG_NETFILTER_XT_MATCH_OWNER=m

CONFIG_NETFILTER_XT_MATCH_POLICY=m

CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m

CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m

CONFIG_NETFILTER_XT_MATCH_QUOTA=m

CONFIG_NETFILTER_XT_MATCH_RATEEST=m

CONFIG_NETFILTER_XT_MATCH_REALM=m

CONFIG_NETFILTER_XT_MATCH_RECENT=m

CONFIG_NETFILTER_XT_MATCH_SCTP=m

CONFIG_NETFILTER_XT_MATCH_SOCKET=m

CONFIG_NETFILTER_XT_MATCH_STATE=m

CONFIG_NETFILTER_XT_MATCH_STATISTIC=m

CONFIG_NETFILTER_XT_MATCH_STRING=m

CONFIG_NETFILTER_XT_MATCH_TCPMSS=m

CONFIG_NETFILTER_XT_MATCH_TIME=m

CONFIG_NETFILTER_XT_MATCH_U32=m

```

 :Very Happy: 

----------

## samuelbernardo

Thanks alamahant for your post.

It's working now with your proposed configurations.

----------

