Next Previous Contents

netfilter/iptables FAQ

Harald Welte <coreteam@netfilter.org>

Version $Revision: 6856 $, $Date: 2007-06-04 13:38:34 +0200 (lun, 04 jun 2007) $

This document contains the Frequently Asked Questions as encountered on the netfilter mailing list. Comments / additions / clarifications are appreciated and should be directed to the FAQ maintainer.

1. General Questions

1.1 Where can I get netfilter/iptables?
1.2 Is there a backport of netfilter to Linux 2.2?
1.3 Is there an ICQ conntrack/NAT helper module?
1.4 Where did the ip_masq_vdolive / ip_masq_quake / ... modules go?
1.5 What is this patch-o-matic all about and how do I use it?
1.6 Where can I find ipnatctl and more information about it?
1.7 Can iptables/ip6tables do IPv6 NAT?
1.8 Are there any plans to support SIP?
1.9 Does netfilter/iptables support failover/HA?

2. Problems during the build process

2.1 I cannot compile iptables-1.1.1 with kernel >= 2.4.0-test4
2.2 I cannot compile iptables 1.1.0 with recent kernels (>= 2.3.99-pre8)
2.3 Some patch-o-matic patches from iptables >= 1.2.1a don't work with kernel >= 2.4.4
2.4 ipt_BALANCE, ip_nat_ftp, ip_nat_irc, ipt_SAME, ipt_NETMAP don't compile
2.5 I'm using Alan Cox' 2.4.x-acXX series kernel and I experience problems
2.6 ERROR: Invalid option KERNEL_DIR=/usr/src/linux-2.4.19

3. Problems at runtime

3.1 NAT: X dropping untracked packet Y Z aaa.aaa.aaa.aaa -> 224.bbb.bbb.bbb
3.2 NAT: X dropping untracked packet Y Z aaa.aaa.aaa.aaa -> bbb.bbb.bbb.bbb
3.3 ip_conntrack: max number of expected connections N of M reached for aaa.aaa.aaa.aaa -> bbb.bbb.bbb.bbb
3.4 I'm unable to use netfilter in combination with the Linux bridging code
3.5 The IRC module is unable to handle DCC RESUME
3.6 How does SNAT to multiple addresses work?
3.7 ip_conntrack: maximum limit of XXX entries exceeded
3.8 How do I list all tracked / masqueraded connections, similar to 'ipchains -L -M' in 2.2.x ?
3.9 How do I list all available IP tables?
3.10 iptables-save / iptables-restore from iptables-1.2 segfaults
3.11 iptables -L takes a very long time to display the rules
3.12 How do I stop the LOG target from logging to my console?
3.13 How do I build a transparent proxy using squid and iptables?
3.14 How do I use the LOG target / How can i LOG and DROP?
3.15 How do I stop worm XYZ with netfilter ?
3.16 kernel logs: Out of window data xxx
3.17 Why does the connection tracking system track UNREPLIED connections with a high timeout?
3.18 Why isn't the 'iptables -C' (--check) option implemented?
3.19 Why can't i use the REJECT target in PREROUTING chains?
3.20 'iptables: Invalid argument' after kernel update (nat table)

4. Questions about netfilter development

4.1 I don't understand how to use the QUEUE target from userspace
4.2 My libipq application says "Failed to received netlink message: No buffer space available"
4.3 I want to contribute some code, but have no idea what to do
4.4 I've fixed a bug or written an extension. How do I contribute it?
4.5 Is there an C/C++ API for adding/removing rules?

Next Previous Contents