Re: Problem with 2.4.28 kernel config

Shawn Wright
Wed, 01 Dec 2004 05:16:07 -0000

On 30 Nov 2004 at 15:28, Tom Eastep wrote:

> > > > > Clearly it thinks "Connection Tracking Match: Not
available", yet I have set
> > > > > the kernel compile options as follows. The only missing
"match" module is
> > > > > "TLL Match Support", but that is also missing
from the example config on
> > > > > shorewall.net. Before I recompile, is this error caused
by some other
> > > > > issue that I''m not seeing? I did not get this
on previous kernels, which I
> > > > > *thought* I had configured the same.
> > > >
> > > > At a root shell prompt, try:
> > > >
> > > > iptables -N foobar
> > > > iptables -A foobar -M CONNTRACK --ctorigdst 192.168.1.1 -j
ACCEPT
> > > >
> > > F..king caps lock key...
> > >
> > > That should have been:
> > >
> > > iptables -A foobar -m conntrack --ctorigdst 192.168.1.1 -j ACCEPT
> >
> > Here it is:
> >
> > [root@fw mibs]# iptables -N foobar
> > [root@fw mibs]# iptables -A foobar -m conntrack --ctorigdst
192.168.1.1 -j
> > ACCEPT
> > iptables: Invalid argument
> >
> > "invalid argument" is also what I saw in my trace of
''shorewall start'', but I
> > didn''t think it was related, as it went away when I removed
all the entries
> > in the masq file.
> >
> > Here''s the trace portion where it fails with the masq
entries:
> > -------------
> > + run_iptables -t nat -A eth1_masq -s 10.2.200.0/24 -d 0.0.0.0/0 -j
SNAT -
> > -to-source 139.142.65.147
> > + ''['' -n '''' '']''
> > + iptables -t nat -A eth1_masq -s 10.2.200.0/24 -d 0.0.0.0/0 -j SNAT
--to-
> > source 139.142.65.147
> > iptables: Invalid argument
>
> Your iptables is incompatible with your new kernel. You must rebuild
> iptables against the 2.4.28 kernel tree.
>
> Please see Shorewall FAQ #27a.
>
That did it. Thanks, Tom.

ps: just a warning to others - ''make install'' does not copy
the iptables files
to /sbin and /lib/iptables, at least on Mandrake 9.2. You may need to do
this by hand, or make symlinks.