Constantly got iptables-legacy warning in the log
VenusGen opened this issue · comments
ipv6nat_1 | # Warning: iptables-legacy tables present, use iptables-legacy to see them
This warning appears every time when I print out logs. Is there any way to fix that?
This is probably caused by the fact that you have to kernel subsystems running to provide firewall functionalities for your system.
Excerpt from own tutorial
With Debian 10 Buster there are two kernel subsystems which will handle firewall jobs for your system: nf_tables (nftables) and x_tables (iptables). In addition to that, it is possible to use the new subsystem (nftables) by configuring it with legacy commands (iptables/ip6tables). Docker CE also does not provide native support for nftables at the moment. As using both kernel subsystems is not recommened due to unexpected behavior, we will only use x_tables and the legacy iptables/ip6tables commands.
As we only want to use the x_tables subsystem, we will disable the nf_tables kernel module to prevent any unintended loading of this module:
cat << \EOF > /etc/modprobe.d/nftables.conf
install nf_tables /bin/false
EOF
Docker uses the br_netfilter kernel module which sometimes cannot be loaded dynamically by the docker daemon itself. To make sure that this module is loaded, we will directly load it on boot:
cat << \EOF > /etc/modules-load.d/br_netfilter.conf
br_netfilter
EOF
We need to force the usage of the legacy commands for iptables/ip6tables:
update-alternatives --set iptables /usr/sbin/iptables-legacy
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
This may also be a problem if you do not run Debian 10 Buster.
Just did a new release (v0.4.2) that should resolve this issue for most cases.