2.6.20 iptables nat Problem?

Is anyone aware of the change that causes this problem ... I'm
researching but I thought I'd ask in case its a common "issue".

I just compiled the new 2.6.20 kernel, doing an oldconfig with my old
2.6.19 settings.

On reboot the NAT module isn't available and all my iptables commands
fail and my intranet isn't working.

Any one have a similar experience? Any solutions?

Thanks in advance.
--
------------------------------------------------
[url]http://www3.sympatico.ca/dmitton[/url]
SPAM Reduction: Remove "x." from my domain.
------------------------------------------------

--
Posted via a free Usenet account from [url]http://www.teranews.com[/url]

On Sun, 04 Feb 2007 23:13:26 -0500, Doug Mitton <doug_mitton@hotmail.x.com> wrote:
[color=blue]
>
>Is anyone aware of the change that causes this problem ... I'm
>researching but I thought I'd ask in case its a common "issue".
>
>I just compiled the new 2.6.20 kernel, doing an oldconfig with my old
>2.6.19 settings.
>
>On reboot the NAT module isn't available and all my iptables commands
>fail and my intranet isn't working.
>
>Any one have a similar experience? Any solutions?[/color]

Pay attention to the netfilter settings, I think there were some
gratuitous option name changes.

Grant.
--
[url]http://bugsplatter.mine.nu/[/url]

Grant <g_r_a_n_t_@dodo.com.au> wrote:
[color=blue]
>On Sun, 04 Feb 2007 23:13:26 -0500, Doug Mitton <doug_mitton@hotmail.x.com> wrote:
>[color=green]
>>Is anyone aware of the change that causes this problem ... I'm
>>researching but I thought I'd ask in case its a common "issue".
>>
>>I just compiled the new 2.6.20 kernel, doing an oldconfig with my old
>>2.6.19 settings.
>>
>>On reboot the NAT module isn't available and all my iptables commands
>>fail and my intranet isn't working.
>>
>>Any one have a similar experience? Any solutions?[/color]
>
>Pay attention to the netfilter settings, I think there were some
>gratuitous option name changes.
>
>Grant.[/color]

What a strange change to be making ... I think I've found all the
hidden options, at least my .config looks like the recommended from
the UseNet posts I can find.

I'm just recompiling now, I'll see how it goes.

Thanks for the pointer. It took many attempts to get the correct
search stanza for a coherent result. Its surprising how few posts
I've seen on this.

--
------------------------------------------------
[url]http://www3.sympatico.ca/dmitton[/url]
SPAM Reduction: Remove "x." from my domain.
------------------------------------------------

--
Posted via a free Usenet account from [url]http://www.teranews.com[/url]

Doug Mitton <doug_mitton@hotmail.x.com> wrote:
[color=blue]
>Grant <g_r_a_n_t_@dodo.com.au> wrote:
>[color=green]
>>On Sun, 04 Feb 2007 23:13:26 -0500, Doug Mitton <doug_mitton@hotmail.x.com> wrote:
>>[color=darkred]
>>>Is anyone aware of the change that causes this problem ... I'm
>>>researching but I thought I'd ask in case its a common "issue".
>>>
>>>I just compiled the new 2.6.20 kernel, doing an oldconfig with my old
>>>2.6.19 settings.
>>>
>>>On reboot the NAT module isn't available and all my iptables commands
>>>fail and my intranet isn't working.
>>>
>>>Any one have a similar experience? Any solutions?[/color]
>>
>>Pay attention to the netfilter settings, I think there were some
>>gratuitous option name changes.
>>
>>Grant.[/color]
>
>What a strange change to be making ... I think I've found all the
>hidden options, at least my .config looks like the recommended from
>the UseNet posts I can find.
>
>I'm just recompiling now, I'll see how it goes.
>
>Thanks for the pointer. It took many attempts to get the correct
>search stanza for a coherent result. Its surprising how few posts
>I've seen on this.[/color]

Well, the new configuration worked. It took some poking around but I
finally made the .config look like the one posted here:

[url]http://groups.google.com/group/fa.linux.kernel/browse_thread/thread/97947dc71fea5071/8dc96d11c364c850?lnk=st&q=&rnum=4#8dc96d11c364c850[/url]

Go back about 4 responses in this thread (to Sun, Jan 21, 2007 at
11:48:07AM -0500)

Hope this helps someone else!

--
------------------------------------------------
[url]http://www3.sympatico.ca/dmitton[/url]
SPAM Reduction: Remove "x." from my domain.
------------------------------------------------

--
Posted via a free Usenet account from [url]http://www.teranews.com[/url]

Hello,

Grant a écrit :[color=blue]
>
> Pay attention to the netfilter settings, I think there were some
> gratuitous option name changes.[/color]

"Gratuitous" ?
Linux 2.6.20 offers two mutually-exclusive connection tracking and NAT
frameworks :
- the old legacy IPv4-only ip_conntrack/ip_nat ;
- the new layer 3 independant nf_conntrack/nf_nat, which supports IPv6.

So I guess separate option names are needed for each framework.

The new nf_conntrack framework was introduced in Linux 2.6.15 but may
have remained rather unnoticed because it lacked support for NAT and
connection tracking for many "special" protocols (PPTP, H.323, IRC DCC,
SIP...) until Linux 2.6.20, so the old ip_conntrack was still the
default. Now the new nf_conntrack/nf_nat framework is "complete", it
will eventually replace the old ip_conntrack.

Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> wrote:
[color=blue]
>Hello,
>
>Grant a écrit :[color=green]
>>
>> Pay attention to the netfilter settings, I think there were some
>> gratuitous option name changes.[/color]
>
>"Gratuitous" ?
>Linux 2.6.20 offers two mutually-exclusive connection tracking and NAT
>frameworks :
>- the old legacy IPv4-only ip_conntrack/ip_nat ;
>- the new layer 3 independant nf_conntrack/nf_nat, which supports IPv6.
>
>So I guess separate option names are needed for each framework.
>
>The new nf_conntrack framework was introduced in Linux 2.6.15 but may
>have remained rather unnoticed because it lacked support for NAT and
>connection tracking for many "special" protocols (PPTP, H.323, IRC DCC,
>SIP...) until Linux 2.6.20, so the old ip_conntrack was still the
>default. Now the new nf_conntrack/nf_nat framework is "complete", it
>will eventually replace the old ip_conntrack.[/color]

There are some days I wish we could go back to the "old" stable vs
development code streams. A change like this one could mean some BIG
configuration changes to an installed system.

I've always tried to keep updated to the current stable kernel but
this is making it a little more difficult if you're not a developer
.... and up-to-date on the changes.

Thanks for the explanation.

--
------------------------------------------------
[url]http://www3.sympatico.ca/dmitton[/url]
SPAM Reduction: Remove "x." from my domain.
------------------------------------------------

--
Posted via a free Usenet account from [url]http://www.teranews.com[/url]

Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> wrote:
[color=blue]
>Hello,
>
>Grant a écrit :[color=green]
>>
>> Pay attention to the netfilter settings, I think there were some
>> gratuitous option name changes.[/color]
>
>"Gratuitous" ?
>Linux 2.6.20 offers two mutually-exclusive connection tracking and NAT
>frameworks :
>- the old legacy IPv4-only ip_conntrack/ip_nat ;
>- the new layer 3 independant nf_conntrack/nf_nat, which supports IPv6.
>
>So I guess separate option names are needed for each framework.
>
>The new nf_conntrack framework was introduced in Linux 2.6.15 but may
>have remained rather unnoticed because it lacked support for NAT and
>connection tracking for many "special" protocols (PPTP, H.323, IRC DCC,
>SIP...) until Linux 2.6.20, so the old ip_conntrack was still the
>default. Now the new nf_conntrack/nf_nat framework is "complete", it
>will eventually replace the old ip_conntrack.[/color]

Do you know of any "official" URL's that discuss this change and what
changes must be made to firewall rules to use the new framework?

I want to start migrating my scripts to the new system.

Thanks!
--
------------------------------------------------
[url]http://www3.sympatico.ca/dmitton[/url]
SPAM Reduction: Remove "x." from my domain.
------------------------------------------------

--
Posted via a free Usenet account from [url]http://www.teranews.com[/url]

Doug Mitton a écrit :[color=blue]
>
> Do you know of any "official" URL's that discuss this change and what
> changes must be made to firewall rules to use the new framework?[/color]

No, and AFAIK there are no userland changes. Some module names change
(for instance ip_contrack_xx becomes nf_conntrack_xx) but aliases with
the old names have been defined, so the transition to nf_conntrack
should be transparent for most iptables rulesets.