# Iptables

## josiah47

Im trying to follow this guide

http://gentoo-wiki.com/HOWTO_Iptables_for_newbies#Kernel_Support

But when i get to this command 

iptables-save > /etc/iptables.bak

i get this error

getsockopt failed strangely: No such file or directory

i have compiled support directly into the kernel, have double checked it, and even recompiled and tried again.

Do i have to compile them as modules?

Also anytime i try to do something with iptables it give the command, like start it, or trying to run ipkungfu.

Can anyone help me out?

Thanks

----------

## ecks

loading them as modules would be alot easier to debug, id suggest you do that, and then manually try to load the modules into the kernel using modprobe and lsmod. if it gives you any errors at least you will know which module failed. you can also try looking at this guide too for the kernel options you have to enable. good luck and if youre still having trouble, please post your .config file.

----------

## Hu

Building it into the kernel is fine.  Please post the output of emerge --info; emerge -pv iptables; zgrep -E '^[^#]' /proc/config.gz.  Also, when posting error messages, please include the exact error text.  Ideally, use the [code] (see Forum help: Outputting code or fixed width data) tag and include both the command you typed and the output it produced.

----------

## josiah47

```
 

bogie ~ # iptables-save /etc/iptables.bak

getsockopt failed strangely: No such file or directory

bogie ~ # ipkungfu

Checking configuration...

getsockopt failed strangely: No such file or directory

ipkungfu can't create new chains or the script was interrupted previously!

Flushing iptables rulesets...

getsockopt failed strangely: No such file or directory

Clearing old chains and tables...

getsockopt failed strangely: No such file or directory

getsockopt failed strangely: No such file or directory

Your kernel lacks LOG support required by this script. Aborting.

bogie ~ # /etc/init.d/iptables stop

 * WARNING:  iptables has not yet been started.

bogie ~ # /etc/init.d/iptables start

 * Loading iptables state and starting firewall ...

getsockopt failed strangely: No such file or directory                                                                 [ !! ]

bogie ~ # iptables-save > /etc/iptables.bak

getsockopt failed strangely: No such file or directory

bogie ~ # emerge --info

Portage 2.1.2.7 (default-linux/x86/2007.0, gcc-4.1.1, glibc-2.5-r0, 2.6.20-gentoo-r8 i686)

=================================================================

System uname: 2.6.20-gentoo-r8 i686 Pentium III (Katmai)

Gentoo Base System release 1.12.9

Timestamp of tree: Wed, 20 Jun 2007 14:00:01 +0000

dev-lang/python:     2.4.3-r4

dev-python/pycrypto: 2.0.1-r5

sys-apps/sandbox:    1.2.17

sys-devel/autoconf:  2.61

sys-devel/automake:  1.6.3, 1.9.6-r2, 1.10

sys-devel/binutils:  2.16.1-r3

sys-devel/gcc-config: 1.3.14

sys-devel/libtool:   1.5.22

virtual/os-headers:  2.6.17-r2

ACCEPT_KEYWORDS="x86"

AUTOCLEAN="yes"

CBUILD="i686-pc-linux-gnu"

CFLAGS="-O2 -march=pentium3 -pipe"

CHOST="i686-pc-linux-gnu"

CONFIG_PROTECT="/etc /usr/share/X11/xkb"

CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/terminfo"

CXXFLAGS="-O2 -march=pentium3 -pipe"

DISTDIR="/usr/portage/distfiles"

FEATURES="distlocks metadata-transfer sandbox sfperms strict"

GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"

MAKEOPTS="-j3"

PKGDIR="/usr/portage/packages"

PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"

PORTAGE_TMPDIR="/var/tmp"

PORTDIR="/usr/portage"

SYNC="rsync://rsync.gentoo.org/gentoo-portage"

USE="7zip acl berkdb bitmap-fonts cli cracklib crypt cups dri fortran gdbm gif gpm iconv ipv6 isdnlog jpeg libg++ midi mudflap mysql ncurses nls nptl nptlonly openmp pam pcre perl png pppd python readline reflection samba session sland slang spl ssl static swat tcpd truetype-fonts type1-fonts unicode x86 xml xorg zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1 emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="via vesa fbdev mach64"

Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY

bogie ~ #

bogie ~ # emerge -pv iptables

These are the packages that would be merged, in order:

Calculating dependencies... done!

[ebuild   R   ] net-firewall/iptables-1.3.5-r4  USE="ipv6 static -extensions -imq -l7filter" 0 kB

Total: 1 package (1 reinstall), Size of downloads: 0 kB

bogie ~ # zgrep -E '^[^#]' /proc/config.gz

CONFIG_X86_32=y

CONFIG_GENERIC_TIME=y

CONFIG_LOCKDEP_SUPPORT=y

CONFIG_STACKTRACE_SUPPORT=y

CONFIG_SEMAPHORE_SLEEPERS=y

CONFIG_X86=y

CONFIG_MMU=y

CONFIG_GENERIC_ISA_DMA=y

CONFIG_GENERIC_IOMAP=y

CONFIG_GENERIC_BUG=y

CONFIG_GENERIC_HWEIGHT=y

CONFIG_ARCH_MAY_HAVE_PC_FDC=y

CONFIG_DMI=y

CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"

CONFIG_EXPERIMENTAL=y

CONFIG_LOCK_KERNEL=y

CONFIG_INIT_ENV_ARG_LIMIT=32

CONFIG_LOCALVERSION=""

CONFIG_LOCALVERSION_AUTO=y

CONFIG_SWAP=y

CONFIG_SYSVIPC=y

CONFIG_POSIX_MQUEUE=y

CONFIG_IKCONFIG=y

CONFIG_IKCONFIG_PROC=y

CONFIG_SYSFS_DEPRECATED=y

CONFIG_INITRAMFS_SOURCE=""

CONFIG_CC_OPTIMIZE_FOR_SIZE=y

CONFIG_SYSCTL=y

CONFIG_UID16=y

CONFIG_SYSCTL_SYSCALL=y

CONFIG_KALLSYMS=y

CONFIG_KALLSYMS_ALL=y

CONFIG_HOTPLUG=y

CONFIG_PRINTK=y

CONFIG_BUG=y

CONFIG_ELF_CORE=y

CONFIG_BASE_FULL=y

CONFIG_FUTEX=y

CONFIG_EPOLL=y

CONFIG_SHMEM=y

CONFIG_SLAB=y

CONFIG_VM_EVENT_COUNTERS=y

CONFIG_RT_MUTEXES=y

CONFIG_BASE_SMALL=0

CONFIG_MODULES=y

CONFIG_MODULE_UNLOAD=y

CONFIG_MODULE_FORCE_UNLOAD=y

CONFIG_STOP_MACHINE=y

CONFIG_BLOCK=y

CONFIG_LBD=y

CONFIG_IOSCHED_NOOP=y

CONFIG_IOSCHED_AS=y

CONFIG_IOSCHED_DEADLINE=y

CONFIG_IOSCHED_CFQ=y

CONFIG_DEFAULT_AS=y

CONFIG_DEFAULT_IOSCHED="anticipatory"

CONFIG_SMP=y

CONFIG_X86_GENERICARCH=y

CONFIG_X86_CYCLONE_TIMER=y

CONFIG_MPENTIUMIII=y

CONFIG_X86_GENERIC=y

CONFIG_X86_CMPXCHG=y

CONFIG_X86_XADD=y

CONFIG_X86_L1_CACHE_SHIFT=7

CONFIG_RWSEM_XCHGADD_ALGORITHM=y

CONFIG_GENERIC_CALIBRATE_DELAY=y

CONFIG_X86_WP_WORKS_OK=y

CONFIG_X86_INVLPG=y

CONFIG_X86_BSWAP=y

CONFIG_X86_POPAD_OK=y

CONFIG_X86_CMPXCHG64=y

CONFIG_X86_GOOD_APIC=y

CONFIG_X86_INTEL_USERCOPY=y

CONFIG_X86_USE_PPRO_CHECKSUM=y

CONFIG_X86_TSC=y

CONFIG_HPET_TIMER=y

CONFIG_HPET_EMULATE_RTC=y

CONFIG_NR_CPUS=32

CONFIG_SCHED_SMT=y

CONFIG_SCHED_MC=y

CONFIG_PREEMPT_VOLUNTARY=y

CONFIG_PREEMPT_BKL=y

CONFIG_X86_LOCAL_APIC=y

CONFIG_X86_IO_APIC=y

CONFIG_X86_MCE=y

CONFIG_X86_MCE_NONFATAL=y

CONFIG_X86_MCE_P4THERMAL=y

CONFIG_VM86=y

CONFIG_MICROCODE=y

CONFIG_MICROCODE_OLD_INTERFACE=y

CONFIG_X86_MSR=y

CONFIG_X86_CPUID=y

CONFIG_HIGHMEM4G=y

CONFIG_PAGE_OFFSET=0xC0000000

CONFIG_HIGHMEM=y

CONFIG_ARCH_POPULATES_NODE_MAP=y

CONFIG_SELECT_MEMORY_MODEL=y

CONFIG_FLATMEM_MANUAL=y

CONFIG_FLATMEM=y

CONFIG_FLAT_NODE_MEM_MAP=y

CONFIG_SPLIT_PTLOCK_CPUS=4

CONFIG_RESOURCES_64BIT=y

CONFIG_MTRR=y

CONFIG_SECCOMP=y

CONFIG_HZ_250=y

CONFIG_HZ=250

CONFIG_PHYSICAL_START=0x100000

CONFIG_PHYSICAL_ALIGN=0x100000

CONFIG_COMPAT_VDSO=y

CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y

CONFIG_PM=y

CONFIG_PM_LEGACY=y

CONFIG_PM_SYSFS_DEPRECATED=y

CONFIG_ACPI=y

CONFIG_ACPI_AC=y

CONFIG_ACPI_BATTERY=y

CONFIG_ACPI_BUTTON=y

CONFIG_ACPI_FAN=y

CONFIG_ACPI_PROCESSOR=y

CONFIG_ACPI_THERMAL=y

CONFIG_ACPI_BLACKLIST_YEAR=2001

CONFIG_ACPI_DEBUG=y

CONFIG_ACPI_EC=y

CONFIG_ACPI_POWER=y

CONFIG_ACPI_SYSTEM=y

CONFIG_X86_PM_TIMER=y

CONFIG_CPU_FREQ=y

CONFIG_CPU_FREQ_TABLE=y

CONFIG_CPU_FREQ_DEBUG=y

CONFIG_CPU_FREQ_STAT=y

CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y

CONFIG_CPU_FREQ_GOV_PERFORMANCE=y

CONFIG_CPU_FREQ_GOV_USERSPACE=y

CONFIG_CPU_FREQ_GOV_ONDEMAND=y

CONFIG_X86_ACPI_CPUFREQ=y

CONFIG_X86_POWERNOW_K8=y

CONFIG_X86_POWERNOW_K8_ACPI=y

CONFIG_X86_ACPI_CPUFREQ_PROC_INTF=y

CONFIG_PCI=y

CONFIG_PCI_GOANY=y

CONFIG_PCI_BIOS=y

CONFIG_PCI_DIRECT=y

CONFIG_PCI_MMCONFIG=y

CONFIG_PCI_MSI=y

CONFIG_ISA_DMA_API=y

CONFIG_K8_NB=y

CONFIG_BINFMT_ELF=y

CONFIG_NET=y

CONFIG_PACKET=y

CONFIG_UNIX=y

CONFIG_XFRM=y

CONFIG_INET=y

CONFIG_IP_MULTICAST=y

CONFIG_IP_FIB_HASH=y

CONFIG_IP_PNP=y

CONFIG_IP_PNP_DHCP=y

CONFIG_INET_XFRM_MODE_TRANSPORT=y

CONFIG_INET_XFRM_MODE_TUNNEL=y

CONFIG_INET_DIAG=y

CONFIG_INET_TCP_DIAG=y

CONFIG_TCP_CONG_CUBIC=y

CONFIG_DEFAULT_TCP_CONG="cubic"

CONFIG_IPV6=y

CONFIG_INET6_XFRM_MODE_TRANSPORT=y

CONFIG_INET6_XFRM_MODE_TUNNEL=y

CONFIG_IPV6_SIT=y

CONFIG_NETFILTER=y

CONFIG_BRIDGE_NETFILTER=y

CONFIG_NF_CONNTRACK_ENABLED=y

CONFIG_NF_CONNTRACK_SUPPORT=y

CONFIG_NF_CONNTRACK=y

CONFIG_NETFILTER_XTABLES=y

CONFIG_NETFILTER_XT_MATCH_STATE=y

CONFIG_NF_CONNTRACK_IPV4=y

CONFIG_NF_CONNTRACK_PROC_COMPAT=y

CONFIG_IP_NF_IPTABLES=y

CONFIG_IP_NF_FILTER=y

CONFIG_BRIDGE=y

CONFIG_LLC=y

CONFIG_STANDALONE=y

CONFIG_PREVENT_FIRMWARE_BUILD=y

CONFIG_FW_LOADER=y

CONFIG_BLK_DEV_FD=y

CONFIG_BLK_CPQ_DA=y

CONFIG_BLK_CPQ_CISS_DA=y

CONFIG_BLK_DEV_LOOP=y

CONFIG_BLK_DEV_RAM=y

CONFIG_BLK_DEV_RAM_COUNT=16

CONFIG_BLK_DEV_RAM_SIZE=4096

CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024

CONFIG_BLK_DEV_INITRD=y

CONFIG_IDE=y

CONFIG_BLK_DEV_IDE=y

CONFIG_BLK_DEV_IDEDISK=y

CONFIG_IDEDISK_MULTI_MODE=y

CONFIG_BLK_DEV_IDECD=y

CONFIG_IDE_GENERIC=y

CONFIG_BLK_DEV_IDEPCI=y

CONFIG_BLK_DEV_IDEDMA_PCI=y

CONFIG_IDEDMA_PCI_AUTO=y

CONFIG_BLK_DEV_AMD74XX=y

CONFIG_BLK_DEV_PIIX=y

CONFIG_BLK_DEV_IDEDMA=y

CONFIG_IDEDMA_AUTO=y

CONFIG_SCSI=y

CONFIG_SCSI_NETLINK=y

CONFIG_BLK_DEV_SD=y

CONFIG_BLK_DEV_SR=y

CONFIG_CHR_DEV_SG=y

CONFIG_SCSI_SPI_ATTRS=y

CONFIG_SCSI_FC_ATTRS=y

CONFIG_BLK_DEV_3W_XXXX_RAID=y

CONFIG_SCSI_AIC7XXX=y

CONFIG_AIC7XXX_CMDS_PER_DEVICE=32

CONFIG_AIC7XXX_RESET_DELAY_MS=5000

CONFIG_AIC7XXX_DEBUG_ENABLE=y

CONFIG_AIC7XXX_DEBUG_MASK=0

CONFIG_AIC7XXX_REG_PRETTY_PRINT=y

CONFIG_SCSI_AIC79XX=y

CONFIG_AIC79XX_CMDS_PER_DEVICE=32

CONFIG_AIC79XX_RESET_DELAY_MS=4000

CONFIG_AIC79XX_DEBUG_MASK=0

CONFIG_ATA=y

CONFIG_SATA_AHCI=y

CONFIG_SATA_SVW=y

CONFIG_ATA_PIIX=y

CONFIG_SATA_NV=y

CONFIG_SATA_SIL=y

CONFIG_SATA_VIA=y

CONFIG_SATA_INTEL_COMBINED=y

CONFIG_MD=y

CONFIG_BLK_DEV_DM=y

CONFIG_FUSION=y

CONFIG_FUSION_SPI=y

CONFIG_FUSION_MAX_SGE=128

CONFIG_IEEE1394=y

CONFIG_IEEE1394_OHCI1394=y

CONFIG_IEEE1394_RAWIO=y

CONFIG_NETDEVICES=y

CONFIG_NET_ETHERNET=y

CONFIG_MII=y

CONFIG_NET_TULIP=y

CONFIG_TULIP=y

CONFIG_NET_PCI=y

CONFIG_E100=y

CONFIG_TLAN=y

CONFIG_ATL1=y

CONFIG_NETCONSOLE=y

CONFIG_NETPOLL=y

CONFIG_NET_POLL_CONTROLLER=y

CONFIG_INPUT=y

CONFIG_INPUT_MOUSEDEV=y

CONFIG_INPUT_MOUSEDEV_PSAUX=y

CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024

CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768

CONFIG_INPUT_EVDEV=y

CONFIG_INPUT_KEYBOARD=y

CONFIG_KEYBOARD_ATKBD=y

CONFIG_INPUT_MOUSE=y

CONFIG_MOUSE_PS2=y

CONFIG_SERIO=y

CONFIG_SERIO_I8042=y

CONFIG_SERIO_LIBPS2=y

CONFIG_VT=y

CONFIG_VT_CONSOLE=y

CONFIG_HW_CONSOLE=y

CONFIG_SERIAL_8250=y

CONFIG_SERIAL_8250_CONSOLE=y

CONFIG_SERIAL_8250_PCI=y

CONFIG_SERIAL_8250_NR_UARTS=4

CONFIG_SERIAL_8250_RUNTIME_UARTS=4

CONFIG_SERIAL_CORE=y

CONFIG_SERIAL_CORE_CONSOLE=y

CONFIG_UNIX98_PTYS=y

CONFIG_LEGACY_PTYS=y

CONFIG_LEGACY_PTY_COUNT=256

CONFIG_HW_RANDOM=y

CONFIG_HW_RANDOM_INTEL=y

CONFIG_HW_RANDOM_AMD=y

CONFIG_HW_RANDOM_GEODE=y

CONFIG_HW_RANDOM_VIA=y

CONFIG_RTC=y

CONFIG_AGP=y

CONFIG_AGP_AMD64=y

CONFIG_AGP_INTEL=y

CONFIG_RAW_DRIVER=y

CONFIG_MAX_RAW_DEVS=256

CONFIG_HPET=y

CONFIG_HPET_MMAP=y

CONFIG_HANGCHECK_TIMER=y

CONFIG_FIRMWARE_EDID=y

CONFIG_VIDEO_SELECT=y

CONFIG_VGA_CONSOLE=y

CONFIG_VGACON_SOFT_SCROLLBACK=y

CONFIG_VGACON_SOFT_SCROLLBACK_SIZE=128

CONFIG_DUMMY_CONSOLE=y

CONFIG_HID=y

CONFIG_USB_ARCH_HAS_HCD=y

CONFIG_USB_ARCH_HAS_OHCI=y

CONFIG_USB_ARCH_HAS_EHCI=y

CONFIG_EXT2_FS=y

CONFIG_EXT2_FS_XATTR=y

CONFIG_EXT2_FS_POSIX_ACL=y

CONFIG_EXT3_FS=y

CONFIG_EXT3_FS_XATTR=y

CONFIG_EXT3_FS_POSIX_ACL=y

CONFIG_JBD=y

CONFIG_FS_MBCACHE=y

CONFIG_REISERFS_FS=y

CONFIG_REISERFS_FS_XATTR=y

CONFIG_REISERFS_FS_POSIX_ACL=y

CONFIG_FS_POSIX_ACL=y

CONFIG_XFS_FS=y

CONFIG_INOTIFY=y

CONFIG_INOTIFY_USER=y

CONFIG_DNOTIFY=y

CONFIG_AUTOFS4_FS=y

CONFIG_GENERIC_ACL=y

CONFIG_ISO9660_FS=y

CONFIG_FAT_FS=y

CONFIG_MSDOS_FS=y

CONFIG_VFAT_FS=y

CONFIG_FAT_DEFAULT_CODEPAGE=437

CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"

CONFIG_PROC_FS=y

CONFIG_PROC_KCORE=y

CONFIG_PROC_SYSCTL=y

CONFIG_SYSFS=y

CONFIG_TMPFS=y

CONFIG_TMPFS_POSIX_ACL=y

CONFIG_HUGETLBFS=y

CONFIG_HUGETLB_PAGE=y

CONFIG_RAMFS=y

CONFIG_NFS_FS=y

CONFIG_NFS_V3=y

CONFIG_NFSD=y

CONFIG_NFSD_V3=y

CONFIG_NFSD_TCP=y

CONFIG_ROOT_NFS=y

CONFIG_LOCKD=y

CONFIG_LOCKD_V4=y

CONFIG_EXPORTFS=y

CONFIG_NFS_COMMON=y

CONFIG_SUNRPC=y

CONFIG_SMB_FS=y

CONFIG_CIFS=y

CONFIG_MSDOS_PARTITION=y

CONFIG_NLS=y

CONFIG_NLS_DEFAULT="iso8859-1"

CONFIG_NLS_CODEPAGE_437=y

CONFIG_NLS_ASCII=y

CONFIG_NLS_ISO8859_1=y

CONFIG_NLS_ISO8859_15=y

CONFIG_NLS_UTF8=y

CONFIG_PROFILING=y

CONFIG_OPROFILE=y

CONFIG_KPROBES=y

CONFIG_TRACE_IRQFLAGS_SUPPORT=y

CONFIG_MAGIC_SYSRQ=y

CONFIG_UNUSED_SYMBOLS=y

CONFIG_DEBUG_KERNEL=y

CONFIG_LOG_BUF_SHIFT=18

CONFIG_DETECT_SOFTLOCKUP=y

CONFIG_DEBUG_BUGVERBOSE=y

CONFIG_EARLY_PRINTK=y

CONFIG_DEBUG_STACKOVERFLOW=y

CONFIG_X86_FIND_SMP_CONFIG=y

CONFIG_X86_MPPARSE=y

CONFIG_DOUBLEFAULT=y

CONFIG_BITREVERSE=y

CONFIG_CRC32=y

CONFIG_PLIST=y

CONFIG_IOMAP_COPY=y

CONFIG_GENERIC_HARDIRQS=y

CONFIG_GENERIC_IRQ_PROBE=y

CONFIG_GENERIC_PENDING_IRQ=y

CONFIG_X86_SMP=y

CONFIG_X86_HT=y

CONFIG_X86_BIOS_REBOOT=y

CONFIG_X86_TRAMPOLINE=y

CONFIG_KTIME_SCALAR=y

bogie ~ #

```

There you go, I have also attach the error at the top the first couple of lines until your command.

Thanks for your help

----------

## Hu

There is nothing obviously wrong with your configuration, but you are missing quite a few options I normally use with firewall machines.  You do not have automatic module loading turned on, which is recommended by the HOWTO (though it should not be required since you built in all the iptables functionality that you built at all).

The only options I use that you do not, which I expect could matter, are CONFIG_NETFILTER_NETLINK=y and CONFIG_IP_NF_MANGLE=y.  I have a good many more differences due to richer tracking and mangling support.  I should emphasize that I am not certain those two options are the cause of your problem, but they are the most obvious differences between my working configuration and your non-working one.

If changing those does not help, build various iptables options as modules and modprobe them until you find the culprit.  I have never seen this particular error message occur, and would like to know which option is relevant, so please post back when you find it.

Based on inspection of the iptables code, you may be able to derive more information by emerging dev-util/strace and running strace iptables-save > /dev/null to show the system calls it makes.  If you post that output, we may be able to isolate which getsockopt call is failing.  However, knowing which call is failing may not enable us to immediately identify the correct kernel configuration option.

----------

## josiah47

bogie ~ # strace iptables-save >/dev/null

execve("/sbin/iptables-save", ["iptables-save"], [/* 28 vars */]) = 0

uname({sys="Linux", node="bogie", ...}) = 0

brk(0)                                  = 0x80ec000

brk(0x80eccb0)                          = 0x80eccb0

set_thread_area({entry_number:-1 -> 6, base_addr:0x80ec830, limit:1048575, seg_3                  2bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useab                  le:1}) = 0

brk(0x810dcb0)                          = 0x810dcb0

brk(0x810e000)                          = 0x810e000

socket(PF_INET, SOCK_RAW, IPPROTO_RAW)  = 3

getsockopt(3, SOL_IP, 0x42 /* IP_??? */, 0xbfeca63a, 0xbfeca658) = -1 ENOENT (No                   such file or directory)

write(2, "getsockopt failed strangely: No "..., 55getsockopt failed strangely: N                  o such file or directory

) = 55

exit_group(1)                           = ?

Process 5738 detached

----------

## DavidMCS

Are you using multiport rules by any chance?

Seems to me I remember some issue with iptables and multiport rules

generating that error.

--

----------

## jakomo

Hi!

I'll take the risk of, perhaps, saying something inapropiate but just a small question  :Wink: 

Do you want to learn iptables or do you just want to setup your firewall?

Because if you're just looking for a way to setup your firewall, guarddog is waaaaay easier  :Wink:  It's a nice graphical application that blocks everything by default and then lets you allow your traffic on a per protocol basis. It's really easy to use. Its companion, guidedog, easily lets you setup masquerading and port forwarding.

But if you need/want to learn iptables, just forget about this  :Smile: 

Have fun,

jakomo

----------

## Hu

jakomo: right now, the iptables commands do not work for him.  As far as I know, all the "firewall builder" tools are just wrappers around iptables, so fixing iptables is a requirement to make progress on this.

Josiah: based on that strace, I think getsockopt is returning -ENOENT for a call of IPT_SO_GET_REVISION_MATCH.  The Netfilter code returns this if it does not find an entry in the match list in x_tables.c.  It appears that this list will be empty with your kernel configuration.  Add support for the IPv4 conntrack match and your problem should go away.  If this works, it would be worth reporting to the Netfilter developers.  It is possible to build a decent firewall without any of the matches that are placed in that list, so requiring those options to be enabled in order to use iptables seems a bit odd.

----------

## josiah47

Hello,

Thanks for all your responses.

i figured it out, i have static as a USE flag in make.conf for something else maybe DHCP.

anyways took it out remerged and bam works like a beaut, now just have to figure out how to route my one network eth1 to eth0 two different subnets

192.168.210.0 on eth1, kiosk network

192.168.201.0 on eth0 , servers

and i want eth1 to talk to eth0 servers

----------

