iptables module problems

[wapcaplet]

Okay, I've found this same question several times here but still no solution that seems to work.

I'm using Mandrake 8.1, and am trying to configure IP masquerading (to share my cable internet connection with the local network). Both the cable connection (eth1) and local network (on eth0) are working fine.

I have iptables 1.2.5 installed, and have *removed* all traces of ipchains, as far as I know. Since this is kernel 2.4.8, everything points me to iptables as the better alternative.

Configured everything using InteractiveBastille, which is supposed to support both ipchains and iptables. Running a test of the server with:

/etc/rc.d/init.d/bastille-firewall start

Spits out lots of errors like:

iptables v1.2.5: can't initialize iptables table `filter': Module is wrong version
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.2.5: can't initialize iptables table `nat': Module is wrong version
Perhaps iptables or your kernel needs to be upgraded.

iptables -L also gives the first error (about filter) but not the second).

Here is what lsmod tells me:

iptable_filter 2048 0 (unused)
ip_nat_ftp 3392 0 (unused)
ipt_LOG 3776 0 (unused)
ip_conntrack_ftp 3792 0 (unused)
iptable_nat 16560 1 [ip_nat_ftp]
ip_tables 11488 5 [iptable_filter ipt_LOG iptable_nat]
ip_conntrack 15600 2 [ip_nat_ftp ip_conntrack_ftp iptable_nat]

It looks like the modules are loaded; they're just not happy with this kernel version. Weird, because:

rpm -q --requires iptables-1.2.5-1.1mdk

Says:

kernel >= 2.4.8

I have considered kernel upgrade, but I'm not confident of my ability to do that just yet. I've looked at newer versions of iptables, but they typically require a newer kernel.

So should I maybe get an older version of iptables? Or is there just something obvious I'm missing?

Help would be greatly appreciated. Let me know if there's any other output I should post.

Thanks in advance!

[neondog]

make sure ipchains is not installed as it will cause similar errors.

[wapcaplet]

I've already removed the ipchains RPM. About the only remaining traces of it are some .h and .c files, the cached RPM it was installed from, and some stuff in /usr/share/webmin (just left-over icons and whatnot).

Bastille installed a script called /usr/share/Bastille/bastille-ipchains, but I don't think that's the problem (besides, it was giving those errors before I ran InteractiveBastille).

Anywhere else I could check to see if there are still some config files referring to ipchains-related stuff?

[neondog]

I've had problems with bastille, as well as several other firewall admin tools. I know you are not gonna want to hear this but I have found that the best way to work iptables is to write your own script, or bogart someone elses. I use iptables to handle nat routing on several networks so I've seen it work and it does a good job of it when properly deployed. I've recently posted iptables info on my homepage for downloading

http://www.hightec.com/~neondog

[neondog]

oh yeah for some reason mozilla doesn't like my website so use Lynx or IE to download the file..its under the Puterz section

[neondog]

looks like you can either downgrade iptables or upgrade the kernel. If youare using rpm's it shouldn't be to hard to upgrade the kernel

[wapcaplet]

Thanks! I will look through this and see if it helps.

btw, I think the reason Mozilla has trouble with your site (or at least with the link to the iptables zip file) is the URL in your href:

Instead of:

<a href="http:./files/iptables_combo.zip">

Try:

<a href="./files/iptables_combo.zip">

[wapcaplet]

Well, I couldn't seem to find a reliable source of new kernel RPMs, so I decided to check out my original installation CDs. Turns out they contain an older version of iptables (1.2.2), and it looks like it's working now! (Or at the very least, those errors have disappeared)

Now I'm getting a couple messages about problems with the bastille-firewall script, so you are probably right that I should edit that stuff by hand. I'm sure I'm capable, I just wanted the easy way to get me started :)

[neondog]

thx for the html help. I tossed it up there quick and dirty. Start with the example for your kernel, it is well commented. Get it running and then get the stronger version running. Use the iptables tutorial to guide you thru it as needed...good luck.

[wapcaplet]

Sweet. It appears to be working now with the Bastille-configured firewall, and the other puter on my home network can connect.

I'll definitely put that iptables tutorial to use, though, to do some tweaking! Thanks again.