From: Kerin Millar <kfm@plushkava.net>
To: Matthew Ellquist <mellqui@d.umn.edu>
Cc: NFTables Mailing List <netfilter@vger.kernel.org>
Subject: Re: iptables debian 11 package
Date: Thu, 29 Jun 2023 03:01:01 +0100 [thread overview]
Message-ID: <20230629030101.5604047cf209ba2fb817ec97@plushkava.net> (raw)
In-Reply-To: <CAOBAZ9C9s5Ko6YHzSqY7hUW2WHnA4zkZWu4pvD=o=4OCV1wTaQ@mail.gmail.com>
On Wed, 28 Jun 2023 20:29:44 -0500
Matthew Ellquist <mellqui@d.umn.edu> wrote:
> Not sure why these packages are behaving differently -- I can't seem
> to figure it out. Maybe someone here can help.
>
> https://i.imgur.com/U2nN6QQ.png
The diagnostic message indicating that the 'filter' table is incompatible tells you at least three things.
Firstly, that the instance of iptables(8) that you have is of the variety that uses the nftables backend, rather than the traditional xtables backend.
Secondly, that an "ip filter" table has been loaded already, probably directly by nft(8). Running "nft list ruleset" will show it.
Thirdly, that the _present_ contents of this table are intrinsically incompatible with the use of iptables(8) in conjunction with the nftables backend (see https://www.redhat.com/en/blog/using-iptables-nft-hybrid-linux-firewall). It is for this reason that iptables(8) aborts and tells you that you should be using nft(8) instead.
Essentially, you need to commit to exclusively using either of nft(8) or iptables(8) to manage your ruleset, rather than attempt to use both at the same time (whether it was by accident or not). Simply installing and uninstalling packages won't flush the currently loaded ruleset and, therefore, won't address this issue.
--
Kerin Millar
prev parent reply other threads:[~2023-06-29 2:01 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-29 1:29 iptables debian 11 package Matthew Ellquist
2023-06-29 2:01 ` Kerin Millar [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230629030101.5604047cf209ba2fb817ec97@plushkava.net \
--to=kfm@plushkava.net \
--cc=mellqui@d.umn.edu \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).