24

I'm having a problem using iptables on my Raspberry PI.
I've just downloaded a fresh version of Raspbian Lite on my PI and all I'm trying to do is check my iptables rules but it's not working and I'm getting this error:
>> iptables -L
iptables/1.8.2 Failed to initialize nft: Protocol not supported
I don't know what to do? could I go back to an older version of iptables or something?
Bare in mind I'm a real beginner in the IT world.

Improve this question

5 Answers 5

Reset to default
23

The solution is here: You need to reboot after a kernel upgrade. The easiest way is of course:

# as root
reboot
Improve this answer
2
  • 5
    Unlike most x86/amd64 distributions, which keep the past few kernels (and their modules) lying around, Raspbian seems to throw them away immediately. So after updating the kernel, it can no longer load new modules. This is fixed by a reboot.
    – Marcel Waldvogel
    Jan 17, 2021 at 13:21
  • 1
    This isn't just raspbian; I'm on pop os 22.04, and a reboot fixed it.
    – Kyle Baker
    Jun 9 at 0:13
11

Raspbian certainly followed its Debian upstream there: by default the newer iptables userland tools are using the nftables kernel API instead of the "legacy" iptables kernel API, as told here:

Current status

NOTE: Debian Buster uses the nftables framework by default.

Starting with Debian Buster, nf_tables is the default backend when using iptables, by means of the iptables-nft layer (i.e, using iptables syntax with the nf_tables kernel subsystem). This also affects ip6tables, arptables and ebtables.

nftables is aiming at completely replacing iptables with extended features, but has a quite different implementation. A compatibility layer will be kept anyway, mostly in the userland tools, but partially in the kernel. This is in addition of the usual iptables "legacy" layer which will still be in the kernel for a long time.

The newer version of iptables is using this compatibility layer. This can be easily verified by running (as root) iptables -V. Result will most certainly be:

# iptables -V
iptables v1.8.2 (nf_tables)

While the legacy version is still shipped:

# iptables-legacy -V
iptables v1.8.2 (legacy)

At the same time I guess your kernel doesn't support nftables for whatever reason.

So you can:

  • get support for nftables in the kernel (and probably also at least NFT_COMPAT). Might require recompiling it or upgrading it in case you kept an older one. If this task requires too much effort, you can use the other alternative,

  • or use legacy version of iptables which will use the usual iptables kernel API. The previous link explains how to do it. As root user do (at least for iptables and ip6tables, and maybe for ebtables and arptables if installed):

    Switching to the legacy version:

    # update-alternatives --set iptables /usr/sbin/iptables-legacy
# update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
# update-alternatives --set arptables /usr/sbin/arptables-legacy
# update-alternatives --set ebtables /usr/sbin/ebtables-legacy
Improve this answer
8
  • update-alternatives: error: alternative /usr/sbin/iptables-legacy for iptables not registered; not setting - any ideas? I'm running as root
    – user3728501
    May 6, 2020 at 1:57
  • @user3728501 what is your distribution, name, version? and what is the distribution's kernel version? Was it provided by the distribution directly or by the provider of your hardware? and what is the version of the package iptables?
    – A.B
    May 6, 2020 at 6:35
  • It's Raspbian, 4.19.97-v7l+ package version is iptables v1.8.2 (legacy). After reboot I just get this instead: update-alternatives --set iptables /usr/sbin/iptables-legacy update-alternatives: error: alternative /usr/sbin/iptables-legacy for iptables not registered; not setting
    – user3728501
    May 6, 2020 at 13:56
  • @user3728501 I took a raspbian image downloaded from raspbian. chrooted into it (using qemu-arm-static) and ran update-alternatives --set iptables /usr/sbin/iptables-legacy result: update-alternatives: using /usr/sbin/iptables-legacy to provide /usr/sbin/iptables (iptables) in manual mode and then iptables -V gave iptables v1.8.2 (legacy)
    – A.B
    May 6, 2020 at 14:16
  • 1
    Me neither, but as this is not really about this Q/A, you should ask it in a separate question with as much details as possible. Maybe somebody with more specific Raspbian experience could answer it. I can just say the image available at downloads.raspberrypi.org/raspbian_lite/images/… doesn't appear to have this behaviour.
    – A.B
    May 6, 2020 at 17:09
2

My errors looked like this:

docker: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

And if you look in sudo cat /var/log/docker.log you find

Running iptables --wait -t nat -L -n failed with message: `iptables/1.8.7 Failed to initialize nft: Protocol not supported`, error: exit status 1

docker install on WSL2

I got these same errors. The fix I found came from here:

https://dev.to/felipecrs/simply-run-docker-on-wsl2-3o8

sudo update-alternatives --set iptables /usr/sbin/iptables-legacy

Hope that helps.

Improve this answer
1
  • Also look at rancher-desktop... It makes installing docker on windows so much easier and it doesn't have the licensing restrictions of docker desktop.
    – phyatt
    Feb 14 at 20:47
0

I was trying to install Docker using their convenience script and when the Docker engine tried to configure iptables it hit me with the same error. This only occured on my old Raspberry Pi B+ Rev 1.2, not on the Raspi 3 B Rev 1.2. The former runs 5.4.51-v7+ whilst the latter run 5.4.51+ and both should be fully up to date, kernel-wise.

To fix that install issue, I ran the update-alternatives commands from @A.B response and this fixed sudo iptables -V from displaying iptables/1.8.2 Failed to initialize nft: Protocol not supported to iptables v1.8.2 (legacy).

However, when trying to run Docker's iptables command after that:

$ sudo iptables --wait -t nat -L -n
iptables v1.8.2 (legacy): can't initialize iptables table `nat': 
Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

Now, the way to fix that was to enable that iptable "legacy" layer @A.B was talking about like so (answer from @conrad):

sudo su -
modprobe ip_tables
echo 'ip_tables' >> /etc/modules
exit

After rebooting to reload the kernel modules, I checked if the docker systemd service started using sudo systemctl status docker and it was running properly.

Improve this answer
3
  • can you shed more on this? I am experiencing the same issue on a 3B+ model but in trying to modprobe ip_tables I get modprobe: ERROR: could not insert 'ip_tables': Exec format error I'm using Linux 5.10.43v64
    – Kendall
    Nov 23, 2021 at 20:15
  • 1
    I'm terribly sorry, it's been more 13 months now and I absolutely don't know anything about this anymore. Since you're using 5.10 and I was on 5.4, it makes sense that my solution may be broken for you now. Best of luck !
    – Samuel Prevost
    Nov 25, 2021 at 9:45
  • @Kendall I ran into exactly the same thing today on a new Pi running Debian 11 / kernel 5.10. I was baffled until I realized that I had upgraded the kernel without rebooting and already autoremoved the old package. Not only was ip_tables unavailable but all modules. Confirmed by comparing versions in /lib/modules against uname. Reboot to load the new kernel got my Docker setup up and going again.
    – Patrick
    Jan 27 at 12:20
0

In my case, the error occurred because I was running wsl version 1 intead of 2

To update wsl to version 2, run wsl --set-version <distro name> 2 replacing with the name of the Linux distribution that you want to update.

For example, wsl --set-version Ubuntu-18.04 2 will set your Ubuntu 18.04 distribution to use WSL 2

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .