16300 2026-05-31 07:08:42 +0000 iptables in core-image-full-cmdline doesn't work 2026-07-16 15:54:13 +0000 1 1 7 Build System, Metadata & Runtime OE-Core oe-core other 6.0.1 x86 x86_64 NEW Medium+ normal 6.1 1 henrik randy.macleod paul randy.macleod yoann.congal --- --- No (bug/feature does not impact docs) oldest_to_newest 105678 0 henrik 2026-05-31 07:08:42 +0000 I built core-image-full-cmdline with poky 6.0.1 as distro and qemux86-64 as machine. After booting and logging in as root, running the simple command "iptables -A INPUT -i lo -j ACCEPT" fails with error "modprobe: FATAL: Module ip_tables not found in directory /lib/modules/6.18.24-yocto-standard". One solution/workaround i found is to enable CONFIG_NETFILTER_XTABLES_LEGACY. 105708 1 randy.macleod 2026-06-04 14:37:20 +0000 Randy to find a person to work on this. Paul is available for consult as needed. 105727 2 paul 2026-06-04 15:56:57 +0000 @Henrik, does it work with the default kernel config if you add `PACKAGECONFIG += "libnftnl"` for iptables? That will require the meta-networking layer. If that works, we may want to bring libnftnl into OE-core and enable that by default going forward. 105728 3 paul 2026-06-04 15:59:05 +0000 Moving this to needinfo. 105762 4 henrik 2026-06-06 08:54:38 +0000 Adding meta-networking and libnftnl to iptables PACKAGECONFIG does indeed work. I did notice a quirk though, that it only works as long as the "ptest" distro feature is enabled. If i add `DISTRO_FEATURES_OPTED_OUT += "ptest"` to local.conf both iptables and nft stop working. Further adding `KERNEL_EXTRA_FEATURES:append = " features/nf_tables/nf_tables.scc"` to local.conf made it work again. 105840 5 randy.macleod 2026-06-11 15:11:16 +0000 This may be design intent in how the nftables cfg work was done. I'll have someone investigate.