Nftable problem

Help and Support
1

Hi, after the upgrade to buster iptables are no more supported so I try to migrate to nftables.
I try to install them

    apt-get install nftables
    systemctl enable nftables.service

The service doesn’t work

systemctl status nftables.service
● nftables.service - nftables
   Loaded: loaded (/lib/systemd/system/nftables.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Fri 2020-12-11 16:16:24 CET; 22min ago
     Docs: man:nft(8)
           http://wiki.nftables.org
 Main PID: 338 (code=exited, status=1/FAILURE)

dic 11 16:16:24 vero4k nft[338]:                      ^^^^^
dic 11 16:16:24 vero4k nft[338]: /etc/nftables.conf:9:15-21: Error: Could not process rule: Operation not supported
dic 11 16:16:24 vero4k nft[338]:         chain forward {
dic 11 16:16:24 vero4k nft[338]:                      ^^^^^^^
dic 11 16:16:24 vero4k nft[338]: /etc/nftables.conf:12:15-20: Error: Could not process rule: Operation not supported
dic 11 16:16:24 vero4k nft[338]:         chain output {
dic 11 16:16:24 vero4k nft[338]:                      ^^^^^^
dic 11 16:16:24 vero4k systemd[1]: nftables.service: Main process exited, code=exited, status=1/FAILURE
dic 11 16:16:24 vero4k systemd[1]: nftables.service: Failed with result 'exit-code'.
dic 11 16:16:24 vero4k systemd[1]: Failed to start nftables.

If I try with “lsmod | grep nft” I don’t have any result.

I see these posts and it seems to be the same problem:
“Enable nftables support (needs nf_tables* kernel modules) · Issue #198 · Hexxeh/rpi-firmware · GitHub”
“Could nf_tables be enabled in raspbian · Issue #2177 · raspberrypi/linux · GitHub”

$ modinfo nf_tables
modinfo: ERROR: Module nf_tables not found.

Coud this be a kernel problem? Thank you in advance for helping
Best regards

2

Yes, it’s a kernel problem. For now, you’ll need to enable iptables-legacy. Auto-mounting and docker not working after latest update - #2 by Tom_Doyle

1 Like
3

Thank you dillthedog, so we are going to wait for the fix that is in a testing state, meanwhile I roll back to iptables.

4

Is there any news about nftables?

5

Support for nftables should be in the next kernel version.