[Shorewall-users] iptables: Invalid argument (found problem)

David T Hollis
Wed, 10 Sep 2003 15:09:02 -0000

Joshua Banks wrote:

>--- David T Hollis <dhollis@davehollis.com> wrote:
>
>
>
>>I could have saved you a few hours of debugging had I checked the list
>>earlier ;).  I had this problem a week or so ago when I setup a Gentoo
>>system with Shorewall.
>>
>>
>
>When I installed iptables, it compiled against
>
>
>>the Gentoo kernel headers which had some additional patches to netfilter
>>etc.  I wound up running with a hand made kernel to meet my requirements
>>and I had a lot of hair pulling with that.  After I rebuild iptables
>>against my kernel headers, everything was fine.
>>
>>
>
>I have no idea what this means. Are you saying that you had to modify the
kernel/netfilter
>settings and then recompile the kernel? I''ve never heard anyone use
the terms that your using.
>Sorry. :)
>
>If so what kernel are you running and what version of Shorewall are you
running. I''m trying to
>compare my settings to someone else.
>Right now I''m running Kernel-2.4.20-gentoo-r6 and Shorewall
1.4.6c...
>
>Thanks,
>JBanks
>
>
>
When I built the system, I was using the 2.4.20-gentoo-r6 kernel.  It
includes a bunch of patches for various things, including a bunch of
netfilter changes.  It seems that some of those changes alter the
structures used by iptables to configure things.   When iptables is
built, it looks for the kernel headers in /usr/src/linux/include which
is the usual location for them, and that is where gentoo has them.  When
I went with my own kernel, the headers were not in that location so when
I rebuilt iptables, it built against the gentoo headers and my problem
persisted.  After realizing this, I removed gentoo''s symlink for
/usr/src/linux and pointed it at my kernel sources directory and rebuilt
iptables and all was well.

To summarize:
Normally iptables isn''t very kernel specific.  I''ve gone from
RH 6
systems to RH9 and I''ve never had a problem with iptables.  I noticed
that the gentoo kernel seemed to include the ''newnat'' patches
for
iptables/netfilter that are not in the mainline kernel.  That is likely
what caused the problem with my installation.  The newnat patches
provide additional connection tracking modules for things like h.323 but
significantly alter the NAT/MASQ interfaces for netfilter.