Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've moved an old Slackware 11 installation from a physical PC to a virtualized in ESXi.

Everything seems to work fine except for one rule in iptables, namely the row:

iptables -t filter -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

The return from iptables is: iptables: Unknown error 4294967295

My googling only leads me to problems when using openVZ.

Full config

#! /bin/sh
/usr/sbin/iptables --flush

# drop all
/usr/sbin/iptables -t filter -I INPUT -j REJECT

# permit established connections and related stuff
iptables -t filter -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# permit all traffic on loopback interface
/usr/sbin/iptables -t filter -I INPUT -i lo -j ACCEPT

# permit ICMP from everywere
/usr/sbin/iptables -t filter -I INPUT -p icmp -j ACCEPT

# permit all traffic from selected hosts
/usr/sbin/iptables -t filter -I INPUT --src HOST.A/32 -j ACCEPT
/usr/sbin/iptables -t filter -I INPUT --src NET.B/25 -j ACCEPT

# permit HTTP & HTTPS traffic from everywhere
/usr/sbin/iptables -t filter -I INPUT -p tcp --dport 80 -j ACCEPT
/usr/sbin/iptables -t filter -I INPUT -p tcp --dport 443 -j ACCEPT

# MySQL
/usr/sbin/iptables -t filter -I INPUT -p tcp --dport 3306 -j ACCEPT

# FTP
/usr/sbin/iptables -t filter -I INPUT -p tcp --dport 21 -j ACCEPT
/usr/sbin/iptables -t filter -I INPUT -p tcp --dport 10500:10550 -j ACCEPT

Any thoughs?

share|improve this question

1 Answer 1

Googling I found that the following modules must be installed or built into the kernel for iptables to work, make sure you have them.

ipt_MASQUERADE   
ipt_helper   
ipt_REDIRECT   
ipt_state   
ipt_TCPMSS   
ipt_LOG    
ipt_TOS    
tun   
iptable_nat
ipt_length
ipt_tcpmss
iptable_mangle
ipt_limit
ipt_tos 
iptable_filter
ipt_helper
ipt_tos 
ipt_ttl 
ipt_REJECT

Use lsmod | less to see the installed modules; if you have build them into the kernel, inspect your kernel config instead.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.