netfilter/iptables FAQ

Harald Welte <laforge@gnumonks.org>

1. General Questions

• 1.1 Where can I get netfilter/iptables?
• 1.2 Is there a backport of netfilter to Linux 2.2?
• 1.3 Is there an ICQ conntrack/NAT helper module?
• 1.4 Where did the ip_masq_vdolive / ip_masq_quake / ... modules go?
• 1.5 What is this patch-o-matic all about and how do I use it?

2. Problems during the build process

• 2.1 I cannot compile iptables-1.1.1 with kernel >= 2.4.0-test4
• 2.2 I cannot compile iptables 1.1.0 with recent kernels (>= 2.3.99-pre8)
• 2.3 If I use the IRC module from patch-o-matic in iptables-1.1.2, I run into problems compiling the patched kernel
• 2.4 If I use the string match module from patch-o-matic in iptables-1.1.2,
• 2.5 iptables-save and iptables-restore don't compile

3. Problems at runtime

• 3.1 My syslog or my console shows the message:
• 3.2 I'm unable to use netfilter in combination with the Linux bridging code
• 3.3 The IRC module is unable to handle DCC RESUME's
• 3.4 How does SNAT to multiple addresses work?
• 3.5 ip_conntrack: maximum limit of XXX entries exceeded

4. Questions about netfilter development

• 4.1 I don't understand how to use the QUEUE target from userspace