Re: linux-2.6.24 & iptables/netfilter

jayjwa <jayjwa@xxxxxxxxxxxxxxxxxxx> wrote:

Doug Mitton <doug_mitton@xxxxxxxxxxxxx> writes:

It's switched to autoconf too, and it seems you're getting ipv6 like
it or not (no disable switch). I don't think the distros have picked
up on this yet as Google has nothing about 2.6.24/iptables. There's
going to have to be some serious reworking done if people are going to
start using 2.6.24. I really hate when the kernel people change
everything and pull the floor out from under all other
projects...don't they realize a kernel does not an operating system
alone make?

I can't comment on the issue above except to say that I just upgraded
from 2.6.23 to 2.6.24 with no problems regarding iptables at all. I
didn't use the patch, I downloaded the entire source tree. Then I
copied over my old .config and did a `make oldconfig` and selected all
default replies to the differences.

Which iptables did you rebuild with? This was iptables--20080127
(snapshot). Some of the stuff did build, but a good chunk of it
didn't. If it bombed or not would depend on if you tried to compile
the extensions that had trouble. Did you notice if yours did build any
of those that are shown erroring out from my log? Maybe I could have
made a go at it, but I saw alot of nat/conntrack stuff fail. Like this
one: libxt_conntrack.c. I'd think that would nix any -m conntrack
rules.

I use a lot of Rules and it is working just fine.

I don't see how, with such basic values being redefined, sometime's
got to break some place. For example:

The system's idea of INADDR_ANY:
/usr/include/netinet/in.h:#define INADDR_ANY ((in_addr_t) /0x00000000)

Redefined in 2.6.24:
/usr/src/linux-2.6.24/include/linux/in.h:#define INADDR_ANY ((unsigned long int) 0x00000000)

There's about 12 such similar issues with all the INADDR_* stuff.

The only issue I'm having with the new kernel is with the new core
scheduler and `dnetc` (Distributed Computing Client) as the default
rules make my system almost unuseable when the load goes up to nearly
100%. Still investigating this.

I didn't even boot it. I'd have liked to, as there seemed to be alot
of new features.


Hmmm, it looks like you are talking about the user utility itself not
just the kernel. Sorry, I didn't update the client this time so I
didn't see the issues. I just implemented my original firewall rules,
verified them and didn't go any further.

--
------------------------------------------------
http://www3.sympatico.ca/dmitton
SPAM Reduction: Remove "x." from my domain.
------------------------------------------------
.

Relevant Pages

  • Re: linux-2.6.24 & iptables/netfilter
    ... I really hate when the kernel people change ... projects...don't they realize a kernel does not an operating system ... from 2.6.23 to 2.6.24 with no problems regarding iptables at all. ... but I saw alot of nat/conntrack stuff fail. ...
    (comp.os.linux.setup)
  • PROBLEM: iptables dont work with 2.4.25
    ... iptables v1.2.6a: can't initialize iptables table `filter': iptables who? ... Perhaps iptables or your kernel needs to be upgraded. ... f000-f0ff: Intel ICH2 ... Controller Hub ...
    (Linux-Kernel)
  • Re: Help with Linux Basics
    ... Then each time the system is booted, iptables loads from ... To run the pure basics of iptables you need to configure the following ... options into the kernel while doing make config or one of its related ... And of course you need to add the proper drivers for your interfaces to work ...
    (alt.os.linux.redhat)
  • Re: Installing IPTables: not very clear howto
    ... >>librairies have to be built according to which kernel modules you'll have. ... >>You should remove any prior iptables version that could be prior in your ... interface you want to config) then make (no need for seperate make dep ... are probably better off simply installing it via the package management ...
    (comp.security.firewalls)
  • Re: Given Up on Linux - New rational please
    ... Either you want to get the machine working with Linux or not. ... work goes into creating a distro, alot of work, years of work, and the only ... Now this goes right back to the kernel, if things are not working on several ... and from the kernel developers and device driver developers side ...
    (alt.os.linux)