Sympl-firewall not updating due to legacy IP tables

Support
1

I’ve got a Mythic Beasts Raspberry Pi with Debian (Raspbian variant) Buster and have noticed the sympl firewall cron/command is giving an error:

# Warning: iptables-legacy tables present, use iptables-legacy-save to see them
sympl-firewall: Firewall script failed.
sympl-firewall: Flushing /sbin/iptables rules and chains.
sympl-firewall: Flushing /sbin/ip6tables rules and chains.
sympl-firewall: Restoring old iptables rules and chains.
sympl-firewall: Restoring old ip6tables rules and chains.
sympl-firewall: Left firewall script in /tmp/user/0/sympl-firewall-20190812-12004-16igwm5-saved for inspection.

What’s the best way to solve this?

2

This looks like a bug triggered by changes to the iptables package in Buster, as they swapped to nftables, and should be reasonably easy to fix (at least in the short term).

Odd that it wasn’t noticed in testing, but I’ll get it fixed ASAP.

1 Like
3

Hi @smsm1, I’ve just pushed a new version out on the testing branch.

If you arent already on it, swap to buster-testing in /etc/apt/sources.list.d/sympl_buster.list and run sympl update, and fingers crossed that should fix it for you.

4

I’ve upgraded to buster-testing, updated, dist-upgraded, and I’m now getting the following output:

sympl@vps2:/var/log$ sudo  /usr/sbin/sympl-firewall
sympl-firewall: Firewall script failed.
sympl-firewall: Flushing /sbin/iptables rules and chains.
sympl-firewall: Flushing /sbin/ip6tables rules and chains.
ip6tables v1.8.2 (legacy): can't initialize ip6tables table `filter': Table does not exist (do you need to insmod?)
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.2 (legacy): can't initialize ip6tables table `filter': Table does not exist (do you need to insmod?)
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.2 (legacy): can't initialize ip6tables table `filter': Table does not exist (do you need to insmod?)
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.2 (legacy): can't initialize ip6tables table `filter': Table does not exist (do you need to insmod?)
Perhaps ip6tables or your kernel needs to be upgraded.
ip6tables v1.8.2 (legacy): can't initialize ip6tables table `filter': Table does not exist (do you need to insmod?)
Perhaps ip6tables or your kernel needs to be upgraded.
sympl-firewall: Restoring old iptables rules and chains.
sympl-firewall: Left firewall script in /tmp/user/0/sympl-firewall-20190816-23795-hydknl-saved for inspection.
5

Looking in the firewall script left behind I’m wondering if there’s an issue around the kernel due to:

sympl@vps2:/var/log$ /sbin/modprobe iptable_filter
modprobe: ERROR: ../libkmod/libkmod.c:586 kmod_search_moddep() could not open moddep file '/lib/modules/4.19.57-v7+/modules.dep.bin'
modprobe: FATAL: Module iptable_filter not found in directory /lib/modules/4.19.57-v7+
sympl@vps2:/var/log$ /sbin/modprobe nf_conntrack
modprobe: ERROR: ../libkmod/libkmod.c:586 kmod_search_moddep() could not open moddep file '/lib/modules/4.19.57-v7+/modules.dep.bin'
modprobe: FATAL: Module nf_conntrack not found in directory /lib/modules/4.19.57-v7+

The kernel version dir is empty, whilst others seem to contain data:

ls -l /lib/modules/4.19.57-v7+/
total 0

For example the highest version:

/lib/modules/4.19.58-v7l+:
total 2108
lrwxrwxrwx  1 root root     35 Jul 19 11:56 build -> /usr/src/linux-headers-4.19.58-v7l+
drwxr-xr-x 11 root root   4096 Jul 23 02:09 kernel
-rw-r--r--  1 root root 535133 Jul 19 11:54 modules.alias
-rw-r--r--  1 root root 553301 Jul 19 11:54 modules.alias.bin
-rw-r--r--  1 root root  11986 Jul 19 11:54 modules.builtin
-rw-r--r--  1 root root  13322 Jul 19 11:54 modules.builtin.bin
-rw-r--r--  1 root root 181537 Jul 19 11:54 modules.dep
-rw-r--r--  1 root root 252058 Jul 19 11:54 modules.dep.bin
-rw-r--r--  1 root root    302 Jul 19 11:54 modules.devname
-rw-r--r--  1 root root  61946 Jul 19 11:54 modules.order
-rw-r--r--  1 root root    352 Jul 19 11:54 modules.softdep
-rw-r--r--  1 root root 232511 Jul 19 11:54 modules.symbols
-rw-r--r--  1 root root 285704 Jul 19 11:54 modules.symbols.bin
6

Rebooting the RPi has resolved this issue and sudo /usr/sbin/sympl-firewall runs without any output which is a good sign.

Thanks.

7

Fingers crossed that should have fixed it - I’ve been unable to replicate it with a clean install on a Pi, and everything looks to be running OK.

1 Like
8

In the past couple of days where was an update with the kernel, and I got the error again. After rebooting the issue had gone away.