Re: Problems with Kernel 2.6.22.1

[Patrick McHardy <kaber@trash.net>]

Thomas B. Preußer wrote:
> Hello,
> 
> having updated my kernel from 2.6.19.2 to 2.6.22.1 both taken as vanilla
> source from kernel.org, I now receive errors when trying to insert rules
> using the state or conntrack modules. I expect other extensions to fail
> as well. The produced error messages suggest some incompatibility
> between the kernel and the userspace iptables:
> 
> # iptables -v -A FORWARD -j ACCEPT -m state --state RELATED,ESTABLISHED
> ACCEPT  all opt -- in * out *  0.0.0.0/0  -> 0.0.0.0/0  state
> RELATED,ESTABLISHED
> iptables: Invalid argument
> 
> # iptables -v -A FORWARD -j ACCEPT -m conntrack --ctstate
> RELATED,ESTABLISHED
> ACCEPT  all opt -- in * out *  0.0.0.0/0  -> 0.0.0.0/0  ctstate
> RELATED,ESTABLISHED
> iptables: Invalid argument
> 
> This problem occurs with both the iptables v1.3.6 coming with Debian and
> a self-compiled iptables v1.3.8 from the netfilter.org download page.
> 
> Is any such issue known? May there be any non-automatic dependencies in
> the kernel configuration going beyond:
> 
> CONFIG_NETFILTER_NETLINK=y
> CONFIG_NF_CONNTRACK_ENABLED=y
> CONFIG_NF_CONNTRACK=y
> CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
> CONFIG_NETFILTER_XT_MATCH_STATE=y


Do you also have CONFIG_NF_CONNTRACK_IPV4 enabled?