Subject: Load legacy iptables module 'iptable_filter' on nftables system
Package: netfilter-persistent
Version: 1.0.11
Severity: minor
File: /usr/sbin/netfilter-persistent

Dear Maintainer,

When using 'netfilter-persistent save' to dump rules on disk, the kernel module 
'iptable_filter' is loaded.
But this is for the 'legacy' iptables. On Debian 10, they now use the 'nft' 

This has the side effect to add a warning to each following 'iptables' command 
we type, adding at the end:
  # Warning: iptables-legacy tables present, use iptables-legacy to see them
on stderr.

The corresponding code is in 
        modprobe -b -q iptable_filter || true

You can test by typing:
iptables -L             # no warning
modprobe -b -q iptable_filter
iptables -L             # warning at the end

I think you can check for nft loaded modules before trying to load the 
iptable_filter, or at least
check if /proc/net/ip_tables_names file already exists. If yes, no need to load 
the module.

Best regards,

-- System Information:
Debian Release: 10.0
  APT prefers stable
  APT policy: (990, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-5-amd64 (SMP w/2 CPU cores)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), 
LANGUAGE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages netfilter-persistent depends on:
ii  lsb-base  10.2019051400

netfilter-persistent recommends no packages.

Versions of packages netfilter-persistent suggests:
ii  iptables-persistent  1.0.11

-- no debconf information

Reply via email to