iptables returns "module is wrong version"

iptables returns "module is wrong version"

[Kurt Yoder]

Hi list

I'm getting an error when running iptables:

root@ns2:~# iptables -L -v
iptables v1.2.11: can't initialize iptables table `filter': Module is
wrong version
Perhaps iptables or your kernel needs to be upgraded.


and yet, iptables module seems to be loaded fine:

root@ns2:~# lsmod
Module                  Size  Used by
iptable_filter          3840  0 
ip_tables              19712  1 iptable_filter
ipv6                  283624  33 
isofs                  38052  0 
af_packet              25676  2 
eepro100               32396  0 
hw_random               6368  0 
amd74xx                15280  0 
evdev                  11456  0 
ohci_hcd               22212  0 
tg3                    70880  0 
firmware_class         11840  1 tg3
e100                   35264  0 
mii                     6464  2 eepro100,e100
capability              6216  0 
commoncap               9280  1 capability
ide_cd                 42848  0 
ide_core              157248  2 amd74xx,ide_cd
cdrom                  39784  1 ide_cd
rtc                    14928  0 
ext3                  122640  1 
jbd                    65072  1 ext3
mbcache                11016  1 ext3
sd_mod                 22016  3 
3w_xxxx                41380  2 
scsi_mod              132544  2 sd_mod,3w_xxxx
unix                   31968  193 
font                    9600  0 
vesafb                  7408  0 
cfbcopyarea             4608  1 vesafb
cfbimgblt               3776  1 vesafb
cfbfillrect             4800  1 vesafb


I'm running kernel 2.6.8 and iptables 1.2.11. I'm using Debian packages
for the kernel and iptables. Anyone encountered this before and been
able to get around it?
--

Kurt Yoder
The Richard Group
tel: 703-525-7156

Re: iptables returns "module is wrong version"

[Jose Maria Lopez]

El mié, 26 de 01 de 2005 a las 18:53, Kurt Yoder escribió:
> Hi list
> 
> I'm getting an error when running iptables:
> 
> root@ns2:~# iptables -L -v
> iptables v1.2.11: can't initialize iptables table `filter': Module is
> wrong version
> Perhaps iptables or your kernel needs to be upgraded.
> 
> 
> and yet, iptables module seems to be loaded fine:
> 
> root@ns2:~# lsmod
> Module                  Size  Used by
> iptable_filter          3840  0 
> ip_tables              19712  1 iptable_filter
> ipv6                  283624  33 
> isofs                  38052  0 
> af_packet              25676  2 
> eepro100               32396  0 
> hw_random               6368  0 
> amd74xx                15280  0 
> evdev                  11456  0 
> ohci_hcd               22212  0 
> tg3                    70880  0 
> firmware_class         11840  1 tg3
> e100                   35264  0 
> mii                     6464  2 eepro100,e100
> capability              6216  0 
> commoncap               9280  1 capability
> ide_cd                 42848  0 
> ide_core              157248  2 amd74xx,ide_cd
> cdrom                  39784  1 ide_cd
> rtc                    14928  0 
> ext3                  122640  1 
> jbd                    65072  1 ext3
> mbcache                11016  1 ext3
> sd_mod                 22016  3 
> 3w_xxxx                41380  2 
> scsi_mod              132544  2 sd_mod,3w_xxxx
> unix                   31968  193 
> font                    9600  0 
> vesafb                  7408  0 
> cfbcopyarea             4608  1 vesafb
> cfbimgblt               3776  1 vesafb
> cfbfillrect             4800  1 vesafb
> 
> 
> I'm running kernel 2.6.8 and iptables 1.2.11. I'm using Debian packages
> for the kernel and iptables. Anyone encountered this before and been
> able to get around it?
> --
> 
> Kurt Yoder
> The Richard Group
> tel: 703-525-7156

You probably don't have your kernel modules and iptables synced.
They both have to be compiled with the same patches of
patch-o-matic or it won't work.

Regards.

-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"

Re: iptables returns "module is wrong version"

[Kurt Yoder]

> El mié, 26 de 01 de 2005 a las 18:53, Kurt Yoder escribió:
> > Hi list
> > 
> > I'm getting an error when running iptables:
> > 
> > root@ns2:~# iptables -L -v
> > iptables v1.2.11: can't initialize iptables table `filter': Module
is
> > wrong version
> > Perhaps iptables or your kernel needs to be upgraded.
> > 
> > 

<snipped>

> > I'm running kernel 2.6.8 and iptables 1.2.11. I'm using Debian
packages
> > for the kernel and iptables. Anyone encountered this before and been
> > able to get around it?
> 
> You probably don't have your kernel modules and iptables synced.
> They both have to be compiled with the same patches of
> patch-o-matic or it won't work.
> 
> Regards.
> 

How do I figure out which patches were applied to the iptables module?

I installed iptables from source with no patches but am still getting
the same error message.

Re: iptables returns "module is wrong version"

[Jose Maria Lopez]

El vie, 28 de 01 de 2005 a las 16:24, Kurt Yoder escribió:
> How do I figure out which patches were applied to the iptables module?
> 
> I installed iptables from source with no patches but am still getting
> the same error message.

You can see what patches (or modules) iptables have compiled looking
into the /usr/lib/iptables or /usr/local/lib/iptables directory, and
the kernel ones in
/lib/modules/<kernel-version>/kernel/net/ipv4/netfilter

but the problem it's that the iptables modules and the kernel modules
must be synced and patched with the same path-o-matic, or it won't
work properly.

Regards.

-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"

Re: iptables returns "module is wrong version"

[Kurt Yoder]

> El vie, 28 de 01 de 2005 a las 16:24, Kurt Yoder escribió:
> > How do I figure out which patches were applied to the iptables
module?
> > 
> > I installed iptables from source with no patches but am still
getting
> > the same error message.
> 
> You can see what patches (or modules) iptables have compiled looking
> into the /usr/lib/iptables or /usr/local/lib/iptables directory, and
> the kernel ones in
> /lib/modules/<kernel-version>/kernel/net/ipv4/netfilter
> 
> but the problem it's that the iptables modules and the kernel modules
> must be synced and patched with the same path-o-matic, or it won't
> work properly.
> 
> Regards.
> 

Thanks for your help so far!

I understand that I need to compile iptables with the same patches as
the iptables kernel module, but I'm still not sure how to determine
which patches the kernel module has. I see a bunch of files in the
kernel lib directory, and another different set in the iptables lib
directory. Is the different list of files sufficient to tell me which
patches I should apply to iptables?

I've got this:

root@ns2:~# ls
/lib/modules/2.6.8-9-amd64-k8-smp/kernel/net/ipv4/netfilter/
arptable_filter.ko      ip_nat_irc.ko         ipt_conntrack.ko
ipt_mark.ko        ipt_REJECT.ko
arp_tables.ko           ip_nat_snmp_basic.ko  ipt_dscp.ko
ipt_MARK.ko        ipt_SAME.ko
arpt_mangle.ko          ip_nat_tftp.ko        ipt_DSCP.ko
ipt_MASQUERADE.ko  ipt_state.ko
ipchains.ko             ip_queue.ko           ipt_ecn.ko
ipt_multiport.ko   ipt_tcpmss.ko
ip_conntrack_amanda.ko  iptable_filter.ko     ipt_ECN.ko
ipt_NETMAP.ko      ipt_TCPMSS.ko
ip_conntrack_ftp.ko     iptable_mangle.ko     ipt_esp.ko
ipt_NOTRACK.ko     ipt_tos.ko
ip_conntrack_irc.ko     iptable_nat.ko        ipt_helper.ko
ipt_owner.ko       ipt_TOS.ko
ip_conntrack.ko         iptable_raw.ko        ipt_iprange.ko
ipt_physdev.ko     ipt_ttl.ko
ip_conntrack_tftp.ko    ip_tables.ko          ipt_length.ko
ipt_pkttype.ko     ipt_ULOG.ko
ipfwadm.ko              ipt_addrtype.ko       ipt_limit.ko
ipt_realm.ko
ip_nat_amanda.ko        ipt_ah.ko             ipt_LOG.ko
ipt_recent.ko
ip_nat_ftp.ko           ipt_CLASSIFY.ko       ipt_mac.ko
ipt_REDIRECT.ko
root@ns2:~# ls /usr/local/lib/iptables/
libip6t_ah.so          libip6t_MARK.so       libipt_DNAT.so
libipt_MASQUERADE.so  libipt_SNAT.so
libip6t_dst.so         libip6t_multiport.so  libipt_dscp.so
libipt_MIRROR.so      libipt_standard.so
libip6t_esp.so         libip6t_owner.so      libipt_DSCP.so
libipt_multiport.so   libipt_state.so
libip6t_eui64.so       libip6t_rt.so         libipt_ecn.so
libipt_NETMAP.so      libipt_TARPIT.so
libip6t_frag.so        libip6t_standard.so   libipt_ECN.so
libipt_NOTRACK.so     libipt_tcpmss.so
libip6t_hbh.so         libip6t_tcp.so        libipt_esp.so
libipt_owner.so       libipt_TCPMSS.so
libip6t_hl.so          libip6t_TRACE.so      libipt_helper.so
libipt_physdev.so     libipt_tcp.so
libip6t_HL.so          libip6t_udp.so        libipt_icmp.so
libipt_pkttype.so     libipt_tos.so
libip6t_icmpv6.so      libipt_addrtype.so    libipt_iprange.so
libipt_realm.so       libipt_TOS.so
libip6t_ipv6header.so  libipt_ah.so          libipt_length.so
libipt_recent.so      libipt_TRACE.so
libip6t_length.so      libipt_CLASSIFY.so    libipt_limit.so
libipt_REDIRECT.so    libipt_ttl.so
libip6t_limit.so       libipt_connlimit.so   libipt_LOG.so
libipt_REJECT.so      libipt_TTL.so
libip6t_LOG.so         libipt_connmark.so    libipt_mac.so
libipt_rpc.so         libipt_udp.so
libip6t_mac.so         libipt_CONNMARK.so    libipt_mark.so
libipt_SAME.so        libipt_ULOG.so
libip6t_mark.so        libipt_conntrack.so   libipt_MARK.so
libipt_sctp.so        libipt_unclean.so

Re: iptables returns "module is wrong version"

[Jose Maria Lopez]

El vie, 28 de 01 de 2005 a las 20:04, Kurt Yoder escribió:
> Thanks for your help so far!
> 
> I understand that I need to compile iptables with the same patches as
> the iptables kernel module, but I'm still not sure how to determine
> which patches the kernel module has. I see a bunch of files in the
> kernel lib directory, and another different set in the iptables lib
> directory. Is the different list of files sufficient to tell me which
> patches I should apply to iptables?

Patch-o-matic patches at the same time the kernel sources and the
iptables sources. You can try to patch a "fake" source from your
kernel so the iptables get patched with the same modules, but I
can't tell you if that would solve your problem.

Regards.

-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"