RockyLinux 8.5: ERROR failed enabling firewall: cannot enable firewall: cannot set iptables policies: failed iptables command

[C0Nd3Mnd]

I have a similar problem as mentioned in #598. I encountered this problem after upgrading from RockyLinux 8.4 to 8.5 (it worked just fine before).

Kernel:

  Operating System: Rocky Linux 8.5 (Green Obsidian)
       CPE OS Name: cpe:/o:rocky:rocky:8.5:GA
            Kernel: Linux 4.18.0-348.2.1.el8_5.x86_64
      Architecture: x86-64

Docker logs:

2021/11/28 00:04:14 ERROR failed enabling firewall: cannot enable firewall: cannot set iptables policies: failed iptables command "iptables --policy INPUT DROP": modprobe: can't change directory to '/lib/modules': No such file or directory
iptables v1.8.7 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.: exit status 3
2021/11/28 00:04:14 INFO Shutdown successful

Output of iptables -nVL:

iptables v1.8.4 (nf_tables)

Note the mismatch in iptables versions (1.8.7 in the container vs 1.8.4 on the host), no idea if this matters though.

Any idea what causes this?

[qdm12]

Your system uses nftables instead of iptables which is the newer thing, although it's still barely available out there generally. That's why gluetun runs with iptables for now.

Try sudo modprobe ip_tables to see if that changes anything? Otherwise I'll have a look.

There is also a plan (not for now now though) to use http://github.com/google/nftables in the future, but that's rather far away especially since most systems still use iptables and not nftables in their kernel.

[C0Nd3Mnd]

Loading the ip_tables module and restarting the container seems to be the solution (or workaround).

I gotta read some more about the whole ip_tables to nf_tables transition and what implications this has, but your solution works for now so thank you!

For anyone else running into this, you should load ip_tables across system restarts by creating the file /etc/modules-load.d/ip_tables.conf (the filename technically doesn't matter) and adding the line ip_tables to it.