# IPtables problem

## KallDrexx

ok I compiled IPtables into a module and:

```

localhost linux # modprobe ip_tables

/lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ip_tables.o: unresolved symbol nf_unregister_sockopt

/lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ip_tables.o: unresolved symbol nf_register_sockopt

/lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ip_tables.o: insmod /lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ip_tables.o failed

/lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ip_tables.o: insmod ip_tables failed

```

same thing with running iptables

```

localhost linux # iptables -A INPUT -s 127.0.0.1 -p icmp -j DROP

/lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ip_tables.o: unresolved symbol nf_unregister_sockopt

/lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ip_tables.o: unresolved symbol nf_register_sockopt

/lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ip_tables.o: insmod /lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ip_tables.o failed

/lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ip_tables.o: insmod ip_tables failed

iptables v1.2.6a: can't initialize iptables table `filter': iptables who? (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

```

Any Ideas?

--KallDrexx

----------

## Nitro

What does running depmod -a tell you?

----------

## KallDrexx

depmod -a returns: 

```

localhost root # depmod -a

depmod: *** Unresolved symbols in /lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ip_conntrack.o

depmod: *** Unresolved symbols in /lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ip_queue.o

depmod: *** Unresolved symbols in /lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ip_tables.o

depmod: *** Unresolved symbols in /lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/ipt_REJECT.o

depmod: *** Unresolved symbols in /lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/iptable_filter.o

depmod: *** Unresolved symbols in /lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/iptable_mangle.o

depmod: *** Unresolved symbols in /lib/modules/2.4.19-r1/kernel/net/ipv4/netfilter/iptable_nat.o

depmod: *** Unresolved symbols in /lib/modules/2.4.19-r1/kernel/net/ipv6/ipv6.o

depmod: *** Unresolved symbols in /lib/modules/2.4.19-r1/kernel/net/ipv6/netfilter/ip6_queue.o

depmod: *** Unresolved symbols in /lib/modules/2.4.19-r1/kernel/net/ipv6/netfilter/ip6_tables.o

depmod: *** Unresolved symbols in /lib/modules/2.4.19-r1/kernel/net/ipv6/netfilter/ip6table_filter.o

depmod: *** Unresolved symbols in /lib/modules/2.4.19-r1/kernel/net/ipv6/netfilter/ip6table_mangle.o

```

I don't know why it's looking for the ipv6 stuff since i haven't loaded the ipv6 module.... *shrugs*

--KallDrexx

----------

## Nitro

Try recompiling your kernel and modules.  That will most likely solve your problem. 

```
cd /usr/src/linux

make clean dep bzImage modules modules_install
```

You will then have to install your kernel in to /boot and update your boot loader accordingly.

----------

## pepper

I'm having pretty much the exact same problem.  I've rebuilt the kernel at leat 15 times with every option mix imaginable.  I've tried building directly into the kernel as well as building as modules.  Did you ever find a soultion to this?

----------

## klieber

 *pepper wrote:*   

> Did you ever find a soultion to this?

 

If you're getting the same kernel errors that KallDrexx posted about above, then you likely have a kernel config problem.   Can you do a:

```
cat /usr/src/linux/.config | grep IP_NF
```

and post the results here.

Also, there's another similar thread about iptables problems here.  might check some of the troubleshooting info there to see if that helps.

--kurt

----------

## shakti

it would be nice to find a solution to this as i have same problem...

----------

## nizZy

Yeah! Ive got the same problem too... I was thinkin' bout System.map where should that file be? Ive tried to compile both ipchains and iptables both as modules and in to the kernel. The only thing that worx, for me, is ipchains in kernel.. But i want iptables. Fuck, have benn compiling for 3 days now =)

----------

## FINITE

There are alot of deps in the kernel that have to also be compiled into the kernel for iptables to work correctly or at all. Basically you would be safe in adding everything under the netfilter catogory accept for the experimental and obvious -do not need- things. I was having problems myself untill figuring out that there needed to be much more compiled in besides ip_tables. Here is a link to an howto that shows the basic things that need to be there:http://www.knowplace.org/netfilter/kernelconfig.html This also seems to be a good site on how to set everything esle up, less cryptic than others I have seen.

----------

## nizZy

i think i solved the problem with a "make mrporper" before everything else..

----------

## shakti

well i found out the following by trial and error:

with my current kernel (2.4.19-r1) i cant get iptables to work...unresolved symbols..whatever i try but everything else works

updating to 2.4.19-gentoo-r5 ip_tables work but i need to disable acpi for keyboard to work but then my comp does not power off by himself and more anoying my mouse will not work, neither usb nor ps2.

this is using the same config file for both times i compile the kernel.

Next step i guess is trying vanilla sources.... altough i would like to know where i fail, i know other people get it to work.

keep on hacking   :Rolling Eyes: 

----------

## Vlad

Take my advice. Compile iptables statically into the kernel. Trying to troubleshoot the depmod errors is tedious and mind numbing.

----------

## shakti

well i am now running vanilla sources and... everything works like a brand new humming ducati...

So it seems there is an issue with the gentoo sources.  :Crying or Very sad: 

----------

## Zu`

 *shakti wrote:*   

> well i am now running vanilla sources and... everything works like a brand new humming ducati...
> 
> So it seems there is an issue with the gentoo sources. 

 

I'm sure it's some kind of misconfiguration. Also, did you do a "make mrproper" before recompiling your kernel with the same sources? 

Greets

----------

## shakti

i use the make mrproper every time i compile a kernel, and used the same config file for all compiles.... so it 'should' have worked no?

----------

## shakti

just a note to end this :

using gentoo r7 sources resolves the problem

----------

## Tuna

just please not end this  :Smile: 

gentoo sources r7 doesnt resolve that problem for me..

i also recompiled a lot of things.. make mrproper.. everything i could think of. still the same error..

then i decided clean up some stuff.. removed the leftovers of my 2.4.19-r1 including modules.. and tried to rebuild 2.4.19-r7 once again.. completely clean.. well.. so now i have screwed ethernet modules too.. nice  :Smile: 

so.. i would really appreciate if someone could explain how the kernel and modules and system.map interact together.. as i obviously do something extremely wrong.. because i honestly dont know whats going on here...

----------

## Tuna

ok.. someone told me that it is most likely a dependency error..

and it looks like that 'make dep' isnt reliable in all cases..

maybe i blew up the ethernet modules myself after spending so much time on that error and getting a little bit upset.. i have to check that.

----------

## Utoxin

I'd recommend that you back up your kernel config, and do a 'make mrproper', then reconfigure the kernel. It sounds like you've got some bad links in your tree somewhere, and make mrproper will clean them up.

----------

## Tuna

i tested another gentoo machine with that.. this time it was a 2.4.18-xfs kernel... well guess what..  same problem there too.. 

i tried mrproper on that 2.4.19 several times.. with r1 and r7.. no go.

i also reconfigured the kernel without loading any .config file to see if i have b0rked something in there..

google does return me about 2 mio other users having that problem.. 4 people replied - and gave tips.. but no one really seems to _know_ whats happening here...

i may paste the error in detail later.. maybe im really just too dump for that..

unresolved symbol nf_unregister_sockopt

unresolved symbol nf_unregistered_hook

something like these are the troublemakers...

p.s. i know compiling the whole iptables stuff into the kernel might work.. but i want to know the solution for that one.. these things are meant to be to work as modules too, right?  :Smile: 

*EDIT*

ok.. i got it working.. i made everything like i did 4 or 5 times before...

maybe i should take a longer nap next time before messing with the kernel.

i obviously missed something

----------

## psp

I've had the same problem - my "solution" has been to:

```
rm -rf /lib/modules/<kernel-version>
```

 And then recompile - everything works great. I have a feeling that the make dep script is indeed not 100% fool-proof. This has happened to me with and without gentoo linux sources.

Not the "best" solution - but a solution. I've also found that the queuing discipline modules are also built even though I don't have them selected. I mean the extras: htb, sfq, cbq... Maybe this is related?

This has only happened to me once I have re-built the kernel w/ iptables and module support.

----------

## virus

I have to second this (from psp)... I had the same problem... tried make mrproper etc. etc. but when I removed the modules in /lib/modules/<kernel version> everything worked suddenly.

----------

## TenPin

I always use the Vanilla kernels as I have never had a problem with them and my server and iptables firewall box has 329 days uptime =).

--

He's got huge, sharp-- eh-- he can leap about-- look at the bones!

----------

## ashkar

i will also verify that removing the modules by hand solved the problem with unresolved dependencies. using gentoo sources 2.4.19-r9

----------

## whit

Dang it. Then read this thread and tried the "make mrproper" which of course (but I'd forgotten it would) tossed out the .config file. Double dang. 

So it the lesson that if you build without iptables, and then build with, you're up a creek unless you totally clean out the first build (mrproper plus its installed modules)??

----------

## Decibels

If any of you use Lilo for the bootloader, I have noticed that you need to rerun lilo (after mounting /boot) to get rid of dep errors after rebuilding a kernel. I haven't used Grub so don't know about it.

----------

## keratos68

Just another point/idea, if /usr/src/linux is a symlink then dump it - thas a BAD idea, infact - Linus recommends not having this symlink.

Each and every time you buil a new kernel, create a new source tree mirroring the current on, and give each new tree a new diorectory name. 

You can make the kernel and modules reflect this new directory be applying some name changes to the top-level Makefile  (in /usr/src/linux-2.4.xxxx) directory.

Always do a "make mrproper" !!

I've solved many a compile prob with this method - but granted it might not fix incompatible kernel support switches - would be nice if the kernel makes could detect or better stil - prevent - this; I mean sometimes you just don't know what the compatability matrix is like for kernel features if you're attempting to build in something for a new device maybe?? This compat issue is already checked by procedures like "make menuconfig", in which some drivers are "disabled" if others are too ... but its not "fully functional"!

So, just some ideas.   :Smile: 

----------

