* not able to set ct state rule
@ 2020-07-17 11:22 Andreas Hoefler
2020-07-17 11:34 ` Florian Westphal
0 siblings, 1 reply; 3+ messages in thread
From: Andreas Hoefler @ 2020-07-17 11:22 UTC (permalink / raw)
To: netfilter
Hi
I am trying to set up a basic connection tracking rule:
#nft list ruleset
table ip filter {
chain input {
type filter hook input priority 0; policy accept;
}
}
# nft add rule filter input ct state established accept
Error: Could not process rule: No such file or directory
add rule filter input ct state established accept
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
cat /proc/config.gz | gunzip | grep NFT
# CONFIG_NFT_NUMGEN is not set
CONFIG_NFT_CT=m
# CONFIG_NFT_FLOW_OFFLOAD is not set
CONFIG_NFT_COUNTER=y
# CONFIG_NFT_CONNLIMIT is not set
CONFIG_NFT_LOG=y
CONFIG_NFT_LIMIT=y
# CONFIG_NFT_MASQ is not set
# CONFIG_NFT_REDIR is not set
CONFIG_NFT_NAT=m
# CONFIG_NFT_TUNNEL is not set
# CONFIG_NFT_OBJREF is not set
# CONFIG_NFT_QUOTA is not set
# CONFIG_NFT_REJECT is not set
# CONFIG_NFT_COMPAT is not set
CONFIG_NFT_HASH=y
# CONFIG_NFT_SOCKET is not set
# CONFIG_NFT_OSF is not set
# CONFIG_NFT_TPROXY is not set
# CONFIG_NFT_DUP_NETDEV is not set
# CONFIG_NFT_FWD_NETDEV is not set
CONFIG_NFT_CHAIN_ROUTE_IPV4=y
# CONFIG_NFT_DUP_IPV4 is not set
# CONFIG_NFT_FIB_IPV4 is not set
CONFIG_NFT_CHAIN_NAT_IPV4=m
# CONFIG_NFT_CHAIN_ROUTE_IPV6 is not set
# CONFIG_NFT_DUP_IPV6 is not set
# CONFIG_NFT_FIB_IPV6 is not set
# CONFIG_NFTL is not set
# CONFIG_INFTL is not set
What am I missing here?
Thx
Andy
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: not able to set ct state rule
2020-07-17 11:22 not able to set ct state rule Andreas Hoefler
@ 2020-07-17 11:34 ` Florian Westphal
2020-07-17 11:49 ` Andreas Hoefler
0 siblings, 1 reply; 3+ messages in thread
From: Florian Westphal @ 2020-07-17 11:34 UTC (permalink / raw)
To: Andreas Hoefler; +Cc: netfilter
Andreas Hoefler <andreas.hoefler@hitachi-powergrids.com> wrote:
> Hi
>
> I am trying to set up a basic connection tracking rule:
> #nft list ruleset
> table ip filter {
> chain input {
> type filter hook input priority 0; policy accept;
> }
> }
> # nft add rule filter input ct state established accept
> Error: Could not process rule: No such file or directory
> add rule filter input ct state established accept
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
works for me on 5.6.18.
> cat /proc/config.gz | gunzip | grep NFT
> # CONFIG_NFT_NUMGEN is not set
> CONFIG_NFT_CT=m
Does "modinfo nft_ct" work?
If its does, is that module loaded?
If not, try to load it manually.
If that makes the rule add work, then module autoloading is broken
on your system for some reason.
^ permalink raw reply [flat|nested] 3+ messages in thread
* RE: not able to set ct state rule
2020-07-17 11:34 ` Florian Westphal
@ 2020-07-17 11:49 ` Andreas Hoefler
0 siblings, 0 replies; 3+ messages in thread
From: Andreas Hoefler @ 2020-07-17 11:49 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter
Hi Florian
Hi
First of all thx for the quick reply.
#modinfo nft_ct
modinfo: ERROR: Module nft_ct not found.
Looks like all the modules are not present.
modprobe nft_ct
modprobe: FATAL: Module nft_ct not found in directory /lib/modules/4.19.94-rt39-g7028856b05
BR
Andy
Andreas Hoefler <andreas.hoefler@hitachi-powergrids.com> wrote:
> Hi
>
> I am trying to set up a basic connection tracking rule:
> #nft list ruleset
> table ip filter {
> chain input {
> type filter hook input priority 0; policy accept;
> }
> }
> # nft add rule filter input ct state established accept
> Error: Could not process rule: No such file or directory add rule
> filter input ct state established accept
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
works for me on 5.6.18.
> cat /proc/config.gz | gunzip | grep NFT # CONFIG_NFT_NUMGEN is not set
> CONFIG_NFT_CT=m
Does "modinfo nft_ct" work?
If its does, is that module loaded?
If not, try to load it manually.
If that makes the rule add work, then module autoloading is broken on your system for some reason.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-07-17 11:49 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-17 11:22 not able to set ct state rule Andreas Hoefler
2020-07-17 11:34 ` Florian Westphal
2020-07-17 11:49 ` Andreas Hoefler
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.