I do have CONFIG_NF_CONNTRACK set.
The bigger problem is that any -m module is not working. tcp, udp, conntrack, comment are all not working.
I find the folder /lib/aarch64-linux-gnu/xtables, and all the relevant .so are in there, but the iptables is still reporting Couldn’t load match ‘tcp/udp/conntrack’:No such file or directory. Me: the file is right over there, and I don’t know where did iptables attempt to find the match files.
I also did export XTABLES_LIBDIR=/lib/aarch64-linux-gnu/xtables
But iptables still can’t seem to read this environmental variable.
I opened a thread on netfilter user list and nobody so far cared to respond.
Which image do you use and how did you installed the kernel and modules.
You should separate kernel modules from application modules. The modules not found are kernel modules which have a fixed position in rootfs like eric wrote I’m sure the environment var you set is for application only
Iptables-legay uses the old modules and syntax for cli tools. Iptables now uses nftables and tries to be a compatibility layer,but maybe not complete (i guess some nftables optiins missing here). I also suggest using nftables directly.
mhm, ok, i thought it is fully tested…have done not much with ipv6 yet…only registered/configured an ipv6 over ipv4 tunnel as i do not have native ipv6…but we are going offtopic…can discuss this separately
Nftables is structured (tree instead of many lines and you can group things instead of having same rules for e.g. different interfaces. Annd only with nftables you will be able to use hw acceleration on mtk boards