Thomas B. Preußer wrote: > Hello, > > having updated my kernel from 2.6.19.2 to 2.6.22.1 both taken as vanilla > source from kernel.org, I now receive errors when trying to insert rules > using the state or conntrack modules. I expect other extensions to fail > as well. The produced error messages suggest some incompatibility > between the kernel and the userspace iptables: > > # iptables -v -A FORWARD -j ACCEPT -m state --state RELATED,ESTABLISHED > ACCEPT all opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 state > RELATED,ESTABLISHED > iptables: Invalid argument > > # iptables -v -A FORWARD -j ACCEPT -m conntrack --ctstate > RELATED,ESTABLISHED > ACCEPT all opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 ctstate > RELATED,ESTABLISHED > iptables: Invalid argument > > This problem occurs with both the iptables v1.3.6 coming with Debian and > a self-compiled iptables v1.3.8 from the netfilter.org download page. > > Is any such issue known? May there be any non-automatic dependencies in > the kernel configuration going beyond: > > CONFIG_NETFILTER_NETLINK=y > CONFIG_NF_CONNTRACK_ENABLED=y > CONFIG_NF_CONNTRACK=y > CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y > CONFIG_NETFILTER_XT_MATCH_STATE=y Do you also have CONFIG_NF_CONNTRACK_IPV4 enabled?
