Re: [Xen-users] How to add iptables modules to Domu Kernel??

["Anand Gupta" <xen.mails@xxxxxxxxx>]

I am using xen 3.0.2 stable and iptables is compiled as module.

Inside domU, i tried the following

-bash-3.00# modprobe iptable_filter
ip_tables: (C) 2000-2006 Netfilter Core Team
-bash-3.00# modprobe iptable_raw
-bash-3.00# modprobe iptable_nat
Netfilter messages via NETLINK v0.30.
ip_conntrack version 2.4 (1056 buckets, 8448 max) - 312 bytes per conntrack
-bash-3.00# modprobe iptable_mangle

Now if i try to load iptables rpm, and run iptables -L, i get the following

iptables v1.2.11: can't initialize iptables table `filter': Module is wrong version
Perhaps iptables or your kernel needs to be upgraded.

Any ideas on how to solve it ?

On 5/27/06, Sadique <sadique@xxxxxxxxxxxxxxxxxxx> wrote:

I am not sure whether iptables module is compiled into the Dom-U kernel
by default in xen binary packages.
The best option for you should be to complie xen kernel from source and
add iptables support statically to the kernel.

make menuconfig
Networking  ---> Networking options  --->  Network packet filtering
(replaces ipchains)  --->  Core Netfilter Configuration  --->  Netfilter
Xtables support (required for ip_tables) and do enable all modules
included in that as per your need.
Then go to - Networking  ---> Networking options  --->  Network packet
filtering (replaces ipchains)  ---> IP: Netfilter Configuration  --->
IP tables support (required for filtering/masq/NAT)

You can only go to the second step after doing the first one.


It's best you add the iptables support statically into the kernel rather than enabling it as a module. Why? If you compile it as a module you need to copy the module to every Dom-U manually.

Thanks
Sadique

miguel c wrote:

> Hi, I'm running xen 2.0 in a Fedora Core 3 distro. My problem is that
> I want to configure a virtual machine so that works as a
> firewall/router. So, I need iptables working on this one.
> Unfortunately I must have some modules loaded such as ip_tables,
> iptables_nat, etc.
> Where can I do this without making mad trying it?
> Thank you  very much
>
>
>
> _______________________________________________
> Xen-users mailing list
> Xen-users@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-users
>
>


_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users

-- 
regards,

Anand Gupta
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users