netfilter/iptables FAQ

Harald Welte <[email protected]>

1. General Questions

• 1.1 Where can I get netfilter/iptables?
• 1.2 Is there a backport of netfilter to Linux 2.2?
• 1.3 Is there an ICQ conntrack/NAT helper module?
• 1.4 Where did the ip_masq_vdolive / ip_masq_quake / ... modules go?
• 1.5 What is this patch-o-matic all about and how do I use it?
• 1.6 Where can I find ipnatctl and more information about it?
• 1.7 Can iptables/ip6tables do IPv6 NAT?
• 1.8 Are there any plans to support SIP?
• 1.9 Does netfilter/iptables support failover/HA?

2. Problems during the build process

• 2.1 I cannot compile iptables-1.1.1 with kernel >= 2.4.0-test4
• 2.2 I cannot compile iptables 1.1.0 with recent kernels (>= 2.3.99-pre8)
• 2.3 Some patch-o-matic patches from iptables >= 1.2.1a don't work with kernel >= 2.4.4
• 2.4 ipt_BALANCE, ip_nat_ftp, ip_nat_irc, ipt_SAME, ipt_NETMAP don't compile
• 2.5 I'm using Alan Cox' 2.4.x-acXX series kernel and I experience problems
• 2.6 ERROR: Invalid option KERNEL_DIR=/usr/src/linux-2.4.19

3. Problems at runtime

• 3.1 NAT: X dropping untracked packet Y Z aaa.aaa.aaa.aaa -> 224.bbb.bbb.bbb
• 3.2 NAT: X dropping untracked packet Y Z aaa.aaa.aaa.aaa -> bbb.bbb.bbb.bbb
• 3.3 ip_conntrack: max number of expected connections N of M reached for aaa.aaa.aaa.aaa -> bbb.bbb.bbb.bbb
• 3.4 I'm unable to use netfilter in combination with the Linux bridging code
• 3.5 The IRC module is unable to handle DCC RESUME
• 3.6 How does SNAT to multiple addresses work?
• 3.7 ip_conntrack: maximum limit of XXX entries exceeded
• 3.8 How do I list all tracked / masqueraded connections, similar to 'ipchains -L -M' in 2.2.x ?
• 3.9 How do I list all available IP tables?
• 3.10 iptables-save / iptables-restore from iptables-1.2 segfaults
• 3.11 iptables -L takes a very long time to display the rules
• 3.12 How do I stop the LOG target from logging to my console?
• 3.13 How do I build a transparent proxy using squid and iptables?
• 3.14 How do I use the LOG target / How can i LOG and DROP?
• 3.15 How do I stop worm XYZ with netfilter ?
• 3.16 kernel logs: Out of window data xxx
• 3.17 Why does the connection tracking system track UNREPLIED connections with a high timeout?
• 3.18 Why isn't the 'iptables -C' (--check) option implemented?
• 3.19 Why can't i use the REJECT target in PREROUTING chains?
• 3.20 'iptables: Invalid argument' after kernel update (nat table)

4. Questions about netfilter development

• 4.1 I don't understand how to use the QUEUE target from userspace
• 4.2 My libipq application says "Failed to received netlink message: No buffer space available"
• 4.3 I want to contribute some code, but have no idea what to do
• 4.4 I've fixed a bug or written an extension. How do I contribute it?
• 4.5 Is there an C/C++ API for adding/removing rules?