Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are using Zentyal 3.1 (Ubuntu 12.04.2 LTS - kernel version: as proxy/firewall for our location. At the moment the firewall rules are set to allow all, however sip packets are still dropped. This is caused by the module nf_conntrack_sip.

When I manually unload the module + the module nf_nat_sip everything works as expected. The command I used for unloading is either (both work):

    rmmod nf_nat_sip
    rmmod nf_conntrack_sip


    modprobe -r nf_nat_sip
    modprobe -r nf_conntrack_sip

After a reboot ofcourse these modules are loaded again, so I added following lines to /etc/modprobe.d/blacklist.conf

    blacklist nf_nat_sip
    blacklist nf_conntrack_sip

But this didn't prevent the modules from loading. I even created a new file, /etc/modprobe.d/blacklist-custom.conf with the same two lines (and a blank new line), but the modules still get loaded at boot.

Then I tried a script that unloads the modules in upstart after the network devices come up, and that works. But after some time the modules do get loaded again by some unknown trigger.

I want these modules unloaded permanently, but kinda clueless atm on any other solutions.

share|improve this question
Ever find an answer to this? – exabrial Aug 4 '14 at 14:42
up vote 0 down vote accepted

Solution for me

In: /etc/zentyal/firewall.conf Remove from iptables_modules = nf_conntrack_sip, nf_nat_sip

Restart Zentyal

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.