Red Hat Bugzilla – Bug 1516881
firewalld modprobe hook breaks iptables rules that automatically load nf_conntrack
Last modified: 2018-04-10 06:32:23 EDT
That call to iptables succeeds on second try. The point is whether nf_conntrack.ko is loaded or not: # lsmod | grep '\(nf_\|xt_\|iptable\|ip_tables\)' # iptables -A INPUT -m connbytes --connbytes 10000:100000 --connbytes-dir both --connbytes-mode bytes iptables: No chain/target/match by that name. # lsmod | grep '\(nf_\|xt_\|iptable\|ip_tables\)' nf_conntrack 262144 0 iptable_filter 262144 0 ip_tables 262144 1 iptable_filter libcrc32c 262144 2 nf_conntrack,xfs # iptables -A INPUT -m connbytes --connbytes 10000:100000 --connbytes-dir both --connbytes-mode bytes # lsmod | grep '\(nf_\|xt_\|iptable\|ip_tables\)' nf_conntrack_ipv4 262144 1 nf_defrag_ipv4 262144 1 nf_conntrack_ipv4 xt_connbytes 262144 1 nf_conntrack 262144 2 nf_conntrack_ipv4,xt_connbytes iptable_filter 262144 1 ip_tables 262144 1 iptable_filter libcrc32c 262144 2 nf_conntrack,xfs # iptables -F INPUT # rmmod nf_conntrack_ipv4 xt_connbytes nf_conntrack # iptables -A INPUT -m connbytes --connbytes 10000:100000 --connbytes-dir both --connbytes-mode bytes iptables: No chain/target/match by that name.
The problem here is caused by /etc/modprobe.d/firewalld-sysctls.conf: If I remove the file, module auto-loading proceeds as expected. The problematic file's content is as such: | install nf_conntrack /usr/sbin/modprobe --ignore-install nf_conntrack && /usr/sbin/sysctl --pattern 'net[.]netfilter[.]nf_conntrack.*' --system This causes a call to sysctl after nf_conntrack has been loaded (either automatically by the kernel or on command line using 'modprobe'). It seems that printing to stdout by sysctl upsets module auto-loading somehow. Adding '--quiet' to the sysctl call fixes the issue. Note that while being at it, one should also add $CMDLINE_OPTS as last parameter to the modprobe call as explained in modprobe.conf(5) to allow passing module parameters via 'modprobe'.
A commit with above mentioned changes is available in my recent pull request upstream: https://github.com/firewalld/firewalld/pull/265
(In reply to Phil Sutter from comment #5) > A commit with above mentioned changes is available in my recent pull request > upstream: https://github.com/firewalld/firewalld/pull/265 Merged upstream, 8a8d61822d.
*** Bug 1519638 has been marked as a duplicate of this bug. ***
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:0702