On Wed, Mar 27, 2013 at 5:22 PM, Eric Blake <eblake@xxxxxxxxxx> wrote: > On 03/25/2013 09:24 PM, Hu Tao wrote: >> On Mon, Mar 25, 2013 at 08:39:40PM +0100, Stefan Seyfried wrote: >>> Hi all, >>> >>> iptables-1.4.18 removed the long deprecated "state" match. >>> Use "conntrack" instead in forwarding rules. >>> Fixes openSUSE bug https://bugzilla.novell.com/811251 #811251. >>> >>> real patch is attached as I'm pretty sure that thunderbird will mess it >>> up otherwise :( >>> >>> Basically it's >>> >>> s/--match state/--match conntrack/ >>> s/--state /--ctstate/ >> >> This is supported by old iptables. (tested with 1.4.14) > > The real question is RHEL 5, which shipped with iptables 1.3.5. But > there, I see this in the man page: Reality is that this interface really relies on the nf-conntrack module, which RHEL 5 doesn't have. The older variant that RHEL 5 does have is xt_conntrack. I know from personal experience that its broken on IPv6 on RHEL5. But what changed between the two I don't remember. The backend providing the information was changed in the early 2.6.2x series, which is what I believe the change is related to. The reason why --state was removed from iptables 1.4.18 is that Linux 3.7 removed the corresponding kernel module. I'd hope that an older iptables running on a newer kernel would report an error with trying to use --state but with past experience with netfilter it a lot of times features you ask for result in a no-op when the kernel doesn't support it by the userland does. This might require a bit more finesse with the detection and choosing whether to use --conntrack or --state for RHEL 5 era systems. -- Doug Goldstein -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list