Mailing List Archive

iptables doesn't load filter rules
recently been trying out the 2.6.18-r{1-3} series of kernels.

They've been _much_ more stable on my Ultra2 wrt disk access.
In fact, I've been able to rebuild my system and bring it up to date,
instead
of living in 2005-land.

The only issue I'm seeing is that I can no longer use IPTables.

wormhole iptables # iptables-restore --verbose --counters <
rules-save.limits
# Generated by iptables-save v1.3.5 on Wed Oct 25 10:38:51 2006
Flushing chain `PREROUTING'
Flushing chain `POSTROUTING'
Flushing chain `OUTPUT'
Flushing chain `Cid4436C759.0'
Deleting chain `Cid4436C759.0'
# Completed on Wed Oct 25 10:38:51 2006
# Generated by iptables-save v1.3.5 on Wed Oct 25 10:38:51 2006
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
getsockopt failed strangely: Invalid argument

The only thing that iptables is setting up is the nat tables. After that
it errors out trying to add the filters.

wormhole iptables # lsmod | grep -iE 'tab|ipt|ip_|net'
iptable_mangle 2048 0
ipt_LOG 6216 0
ipt_REJECT 4672 0
ipt_TOS 1536 0
ipt_MASQUERADE 2376 0
iptable_filter 1920 0
iptable_nat 6148 1
ip_nat 14374 2 ipt_MASQUERADE,iptable_nat
ip_conntrack 43132 3 ipt_MASQUERADE,iptable_nat,ip_nat
nfnetlink 4720 2 ip_nat,ip_conntrack
ip_tables 20064 3 iptable_mangle,iptable_filter,iptable_nat
x_tables 10888 6
ipt_LOG,ipt_REJECT,ipt_TOS,ipt_MASQUERADE,iptable_nat,ip_tables
RE: iptables doesn't load filter rules [ In reply to ]
Replying to myself....
>
> The only issue I'm seeing is that I can no longer use IPTables.


the issues seems to be the multi-port extension, i.e.:

wormhole iptables # modprobe xt_multiport
wormhole iptables # iptables -A INPUT -p udp -m udp -m multiport --dports
68,67,53,123 -m state --state NEW -j ACCEPT
getsockopt failed strangely: Invalid argument


If I break these up into individual lines, they work just fine.

I'll double-check the recent changes, and if needed pass a note
onto the maintainer.

Sometimes you just have to talk to yourself to fix/workaround the problem...