kernel upgrade and no iptables module found on 2.6.17.3
I upgraded my kernel to 2.6.17.3 from 2.6.13 and get a couple boot errors. The first is for my wireless card which needs linuxant's driverloader to work...I have to first uninstall the 2.6.13 driver and then recompile a new wireless driver for my new kernel. I can do this, but don't want to uninstall my NIC driver untill I'm certain that my new kernel works. The second error I don't understand:
FATAL: Module ip_tables not found. iptables-restore v1.3.5: iptables-restore: unable to initializetable 'filter' Error occurred at line: 2 Try `iptables-restore -h' or 'iptables-restore --help' for more information. I don't see an option for iptables in the .config file for 2.6.17.3-does 2.6.17.3 still use a firewall? |
The layout of the kernel changed a bit ago (when 2.6.15 came out if I remember correctly), this mean you need to manually add your netfilters back.
Some other layout changes were made when the 2.6.17 kernel was released also, I would suggest that you take the time and configure the new kernel again making sure you do not miss anything as far as as your hardware is concerned. |
so are ip-tables deprecated (love that word) since kernel 2.6.15? It sounds like all the filtering is done with the kernel itself now-what's that called and where could I read about that?
|
After you built & installed the kernel, did you do a 'make modules_install' to actually put the modules in /lib/modules/?
|
yes I did overnight (it took no more than 10 hours on a 200 MHz box). Here's what I did with the 2.6.17.3 kernel after untarring and moving to /usr/src and making a symlink to /usr/src/linux:
make mrproper copy old .config from 2.6.13 kernel directory to 2.6.17.3 directory make menuconfig make clean make bzImage modules && make modules_install go to bed a /lib/modules/2.6.17.3 directory was built. I also had to use initrd to get it to boot and added needed entry to /etc/lilo and then did lilo. |
No ip-tables are not deprecated, the kernel layout has changed. The .config file from 2.6.13 does not configure the netfilter and other parts of 2.6.17.X. when using make menuconfig you must set these by hand yourself.
Let's make it simple no netfilters means ip-tables does not work, here check you current .config file for 2.6.17.X with is; Code:
# |
This is confusing. I run a server 24/7 and want a good firewall with kernel 2.6.17.3. I was using iptables with some simple rules I found here and understood that a bit. Now the firewall is in the kernel? I need 2 ports to be open for my network to work and I like having ssh and ftp capability. How do I specify that I need certain ports open?
I need to read-what's this new filtering scheme called or do you have a good link? |
Your reading much more into this then what is needed............
The layout has changed nothing else, this means netfilters are in your older 2.6.13 kernel .config file and are still in the newer then 2.6.15 kernels. Please see; http://www.linuxquestions.org/questi...d.php?t=428770 |
I just compiled a 2.6.17.3 kernel last night and am happy to report that it was a flawless compile. I can attest that the layout has changed, but I was able to compile the iptables modules just fine. Everything works just the way it used to. From what I understand, iptables has been "in" the kernel for quite some time, they're just usually modules. I successfully compiled these last night, I'll let you know how I did it.
I don't edit the config file manually anymore, but I use menuconfig exclusively. I would suggest running menuconfig before editing the .config file. For the sake of being thorough, I briefly went over Lenard's post and found it to be what you're looking for. Quote:
When you use {menu,g,x}config for the 2.6.17.3 kernel, the options for iptables from the main menu are: Code:
Networking--> Once the kernel modules are up and running you use iptables just like you always used to... nothing new. :) Good luck... I hope I was able to help. |
I see...my iptables configuration is still good, I just need to enable all the filtering capabilities in the kernel. That's also an informative post.
Thanks for all the help! |
What's the best way to tell which MATCH rules/modules should be included and which to be left out ?
Or can I just compile all of them as modules, as the kernel will only load those it needs anyway, and thus I have absolutely no performance penalty? Is this a correct assumption? Any guides available outlining this to give a better understanding? -Y1 |
All times are GMT -5. The time now is 06:22 AM. |