Red Hat Bugzilla – Bug 1452681
firewalld: ERROR: INVALID_MODULE: nf_nat_ftp
Last modified: 2018-04-10 06:31:38 EDT
Description of problem: When I restart firewalld - it successfully unloads the firewall netfilter kernel modules and loads just the modules that are needed for the new configuration: # systemctl restart firewalld or # firewall-cmd --complete-reload The actual problem is that firewalld unloads netfilter modules which cannot be included in its configuration: we cannot include nf_nat_ftp module into firewalld configuration: as per manual page `man firewall-cmd`: ------------------------------------------------------------------ --permanent --service=service --add-module=module Add a new module to the permanent service. ------------------------------------------------------------------ to include `nf_nat_ftp` kernel module for ftp service I used the mentioned syntax, but once tried I received the following error: Error: INVALID_MODULE: nf_nat_ftp Are there any limitations for the kernel modules which can be included? Version-Release number of selected component (if applicable): > RHEL7.3 # rpm -q firewalld kernel firewalld-0.4.3.2-8.el7.noarch kernel-3.10.0-514.el7.x86_64 How reproducible: # firewall-cmd --permanent --service=ftp --add-module=nf_nat_ftp Error: INVALID_MODULE: nf_nat_ftp Actual results: Error: INVALID_MODULE: nf_nat_ftp Expected results: success
the above command suceeded in newer version, but the module is still not loadable by firewalld due to 'nf_conntrack_' built-in prefix requirement # rpm -q firewalld firewalld-0.4.4.4-3.el7.noarch # firewall-cmd --permanent --service=ftp --add-module=nf_nat_ftp success # firewall-cmd --add-service ftp Error: INVALID_HELPER: nf_nat_ftp # firewall-cmd --permanent --new-helper nat-ftp --module nf_nat_ftp Error: INVALID_MODULE: 'nf_nat_ftp' does not start with 'nf_conntrack_'
Fixed upstream: https://github.com/t-woerner/firewalld/commit/577668e9b788e9982e90f331d934aaa8d79cae56 https://github.com/t-woerner/firewalld/commit/f0109e044e5601fba20d42db24c25e8e8cf804a0 https://github.com/t-woerner/firewalld/commit/af59d816c92e0391d118949542eb19bcf8b74580 https://github.com/t-woerner/firewalld/commit/89a186db02dd3776dce4105d1266b4863b3b4e8b https://github.com/t-woerner/firewalld/commit/34558ad775afd9476c4ec5373b9bc9ee03a195af These patches are adding code to be able to identify NAT helpers and also to load a matching NAT helper if the conntrack helper is used.
granting qa_ack for 7.5; RPL
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:0702