# Iptables [solved]

## HomeUser

Hi,

After installation I have a problem with iptables. It seems not able to communicate with the kernelpart of iptables .

```
Hiere ruiker # iptables -L

iptables v1.3.4: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.
```

I know this is a common one, but I tried the common answers, like kernel options, and it still doesn't work.

I hope - the versions are compateble as I used portage (mostly off-line),

           - the correct options are selected

           - it is not needed to load the modules, they should be linked in the kernel 

           - I run the compiled version of the kernel, as /proc/version indicates it

I am probably missing something. Perhaps somebody can give a hint. Or is it a bug?

```
Hiere ruiker # cat /proc/version

Linux version 2.6.14-gentoo-r5 (root@Hiere) (gcc version 3.4.3 20041125 (Gentoo 3.4.3-r1, ssp-3.4.3-0, pie-8.7.7)) #1 Sun Jan 22 13:55:34 CET 2006

Hiere ruiker # ls /proc/net/ip_*

/proc/net/ip_tables_matches  /proc/net/ip_tables_names  /proc/net/ip_tables_targets

Hiere ruiker # cat /proc/net/ip_tables_matches

comment

addrtype

ttl

length

recent

owner

multiport

multiport

pkttype

iprange

mac

sctp

tcp

udp

icmp

Hiere ruiker # dmesg | grep Net

ip_tables: (C) 2000-2002 Netfilter core team

Netfilter messages via NETLINK v0.30.

Hiere ruiker # zgrep -i netfilter /proc/config.gz

CONFIG_NETFILTER=y

# CONFIG_NETFILTER_DEBUG is not set

CONFIG_NETFILTER_NETLINK=y

# CONFIG_NETFILTER_NETLINK_QUEUE is not set

# CONFIG_NETFILTER_NETLINK_LOG is not set

# IP: Netfilter Configuration

# IPv6: Netfilter Configuration (EXPERIMENTAL)

Hiere ruiker # grep -i netfilter /usr/src/linux/.config

CONFIG_NETFILTER=y

# CONFIG_NETFILTER_DEBUG is not set

CONFIG_NETFILTER_NETLINK=y

# CONFIG_NETFILTER_NETLINK_QUEUE is not set

# CONFIG_NETFILTER_NETLINK_LOG is not set

# IP: Netfilter Configuration

# IPv6: Netfilter Configuration (EXPERIMENTAL)

Hiere ruiker # zgrep -i iptables /proc/config.gz

CONFIG_IP_NF_IPTABLES=y

# CONFIG_IP6_NF_IPTABLES is not set

Hiere ruiker # grep -i iptables /usr/src/linux/.config

CONFIG_IP_NF_IPTABLES=y

# CONFIG_IP6_NF_IPTABLES is not set

iere ruiker # grep -i _IP_NF_ /usr/src/linux/.config

# CONFIG_IP_NF_CONNTRACK is not set

# CONFIG_IP_NF_QUEUE is not set

CONFIG_IP_NF_IPTABLES=y

# CONFIG_IP_NF_MATCH_LIMIT is not set

CONFIG_IP_NF_MATCH_IPRANGE=y

CONFIG_IP_NF_MATCH_MAC=y

CONFIG_IP_NF_MATCH_PKTTYPE=y

# CONFIG_IP_NF_MATCH_MARK is not set

CONFIG_IP_NF_MATCH_MULTIPORT=y

# CONFIG_IP_NF_MATCH_TOS is not set

CONFIG_IP_NF_MATCH_RECENT=y

# CONFIG_IP_NF_MATCH_ECN is not set

# CONFIG_IP_NF_MATCH_DSCP is not set

# CONFIG_IP_NF_MATCH_AH_ESP is not set

CONFIG_IP_NF_MATCH_LENGTH=y

CONFIG_IP_NF_MATCH_TTL=y

# CONFIG_IP_NF_MATCH_TCPMSS is not set

CONFIG_IP_NF_MATCH_OWNER=y

CONFIG_IP_NF_MATCH_ADDRTYPE=y

# CONFIG_IP_NF_MATCH_REALM is not set

CONFIG_IP_NF_MATCH_SCTP=y

# CONFIG_IP_NF_MATCH_DCCP is not set

CONFIG_IP_NF_MATCH_COMMENT=y

# CONFIG_IP_NF_MATCH_HASHLIMIT is not set

# CONFIG_IP_NF_MATCH_STRING is not set

# CONFIG_IP_NF_FILTER is not set

CONFIG_IP_NF_TARGET_LOG=yCONFIG_IP_NF_TARGET_ULOG=y

# CONFIG_IP_NF_TARGET_TCPMSS is not set

# CONFIG_IP_NF_TARGET_NFQUEUE is not set

# CONFIG_IP_NF_MANGLE is not set

# CONFIG_IP_NF_RAW is not set

# CONFIG_IP_NF_ARPTABLES is not set

```

Last edited by HomeUser on Fri Jan 27, 2006 9:01 am; edited 4 times in total

----------

## Xoalin

You will need in the kernel:

Networking --> Network Options --> Network Packet Filtering --> IP: Netfilter Configuration --> IP tables support

Now there are a lot of options available to do various tasks. 

IF you have things setup as a module and not compiled in, you may need to modprobe it. 

Howto's:

Linux Iptables for Newbies Part I: Getting up and running 

Iptables for Newbies Part II: Hardening Your Firwall  

----------

## HomeUser

I think that option is allready activated.

What is the name of that option?

```
<*> IP tables support (required for filtering/masq/NAT) 
```

is activated.

Following http://gentoo-wiki.com/HOWTO_Iptables_for_newbies

```
zgrep -i netfilter /proc/config.gz
```

should give

```
CONFIG_NETFILTER=y
```

I get

```
CONFIG_NETFILTER=y

# CONFIG_NETFILTER_DEBUG is not set

# CONFIG_NETFILTER_NETLINK is not set

# IP: Netfilter Configuration

# IPv6: Netfilter Configuration (EXPERIMENTAL)
```

I suppose /proc/config.gz is linked in the kernel when it is compiled.

----------

## kadeux

Maybe you have noticed it by yourself in the meantime as I am arriving late at this thread, but since there is no "[solved]" comment in the title I should like to direct your attention to this point:

 *HomeUser wrote:*   

> grep -i _IP_NF_ /usr/src/linux/.config
> 
> [..]
> 
> # CONFIG_IP_NF_FILTER is not set

 

----------

## HomeUser

 *kadeux wrote:*   

> ...I should like to direct your attention to this point:
> 
>  *HomeUser wrote:*   grep -i _IP_NF_ /usr/src/linux/.config
> 
> [..]
> ...

 

Thanks for checking the output.  CONFIG_IP_NF_FILTER was the problem.

----------

