【Linux】iptables的内核模块问题大坑！
系统环境
CentOS 6.5
今天本来可以平静的度过一天，正品味着下午茶的美好，突然接到防火墙iptables的报警。
进入到服务器中，执行下面的命令查看，结果报错
/etc/init.d/iptables restart
iptables: Applying firewall rules: iptables-restore v1.4.7: iptables-restore: unable to initialize table 'filter'
Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
一个醒目的失败突然出现
为什么重启防火墙就失败了呀，十分不解，看下报错
报错中说 无法找到初始化的表filter，然而策略中第三行正是filter
但是回想了下，防火墙的策略是没人动的呀，用last查看下
last
最近登陆的除了我自己也没别人
难道自己梦游了？用history查看下修改过策略么
history
也没有呀
那是为什么突然报错呢，在网上找了很多相关的文章
他们说的最多的就是执行
iptables -F强制清空防火墙规则，
于是我将防火墙策略先备份，备份大于一切
cd /etc/sysconfig;cp iptables iptables.2018bak
执行iptables -F
结果又报错了！
[root@zclinux ~]# iptables -F
iptables v1.4.7: can't initialize iptables table `filter': iptables who? (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.这又是啥！ 还是提示filter无法找到
查看下防火墙状态是开启还是已经关闭了
结果又有报错
/etc/init.d/iptables status
iptables: Firewall modules are not loaded.但是报错不一样了，提示我防火墙的模块没有被加载。什么鬼！防火墙模块没有被加载
那我就查看下防火墙模块是否加载了
lsmod | grep iptable成功执行，但是没有任何有价值的内容，这和我预想不得一样啊
那我手动加载一下试试
modprobe ip_tables
modprobe iptable_filter
上面两句都是在网上找的。地址如下：
https://blog.csdn.net/gbenson/article/details/51829585
但是还是没有回显，那还是加载失败呀。
突然想到，防火墙规则要清空的话，我手动清空试下，就将防火墙的配置文件iptables中只留下了头部和COMMIT再次重启，还是老错误
/etc/init.d/iptables restart
iptables: Applying firewall rules: iptables-restore v1.4.7: iptables-restore: unable to initialize table 'filter'
Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]那我先停止在开启呢
于是分别执行如下命令：
/etc/init.d/iptables stop
/etc/init.d/iptables start
我去，都执行成功了，但是为啥没显示ok呢，回忆里都是会有一个ok的呀，不管了，查看下状态
/etc/init.d/iptables status
iptables: Firewall modules are not loaded.
还是报错
同事推荐我在别的服务器中拷贝一个好的iptables文件试下，看是不是文件损坏，结果拷贝回来放在服务器中替换掉，还是报错，报错如上,升级yum，升级内核，升级防火墙 ，reinstall防火墙，reboot全都无果，特别难受，绝望的边缘！！
算了，还是从内核入手看下，他说的模块有问题，我记得加载模块一种是自动查找，一种是手动加载
查看下相关的文章：
文章地址：http://blog.51cto.com/qidai/1835782
我这一看，这第二种刚好符合我的要求，和我的报错类似，但是不同
照着做下；
#modprobe -l|grep iptable
kernel/net/ipv4/netfilter/iptable_filter.ko
kernel/net/ipv4/netfilter/iptable_mangle.ko
kernel/net/ipv4/netfilter/iptable_nat.ko
kernel/net/ipv4/netfilter/iptable_raw.ko
kernel/net/ipv4/netfilter/iptable_security.ko有希望，找到了那个有问题的内核iptable_filter.ko
查看下内核的相关信息
modinfo iptable_filter
filename: /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/iptable_filter.ko
description: iptables filter table
author: Netfilter Core Team
license: GPL
retpoline: Y
srcversion: 666666666666666666668 --已打码
depends: ip_tables
vermagic: `uname -r` SMP mod_unload modversions
parm: forward:bool
导入试下，结果全都失败了
insmod /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/iptable_filter.ko
insmod: error inserting '/lib/modules/`uname -r`/kernel/net/ipv4/netfilter/iptable_filter.ko': -1 Unknown symbol in module
modprobe /lib/modules/`uname -r`kernel/net/ipv4/netfilter/iptable_filter.ko
FATAL: Module /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/iptable_filter.ko not found.我这回直接进到路径底下查看是否存在这个内核：
cd /lib/modules/`uname -r`/kernel/net/ipv4/netfilter
...
-rwxr--r-- 1 root root 8960 Oct 10 00:42 iptable_filter.ko
-rwxr--r-- 1 root root 9008 Oct 10 00:42 iptable_mangle.ko
-rwxr--r-- 1 root root 16232 Oct 10 00:42 iptable_nat.ko
-rwxr--r-- 1 root root 7248 Oct 10 00:42 iptable_raw.ko
-rwxr--r-- 1 root root 7904 Oct 10 00:42 iptable_security.ko
-rwxr--r-- 1 root root 37512 Oct 10 00:42 ip_tables.ko
....这正是我所需要的，哈哈哈哈哈
再次执行命令：
[root@zclinux netfilter]# insmod ip_tables.ko #我感觉应该限制性这个，才对，再执行后面的
[root@zclinux netfilter]# insmod iptable_filter.ko
#lsmod | grep ip #查看下是否导入成功
iptable_filter 2793 0
ip_tables 17895 1 iptable_filter
ipv6 337436 30 nice 导入成功
/etc/init.d/iptables restart
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: iptables-restore v1.4.7: iptables-restore: unable to initialize table 'filter'
Error occurred at line: 2
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]还是failed！ what 不对，换个思路
iptables -vnL
iptables v1.4.7: can't initialize iptables table `filter': iptables who? (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.还是报错，但是已经导进去了呀！
查看下：
#lsmod | grep ip
ipv6 337436 30
没了，一个都没有了
再导入一遍
[root@zclinux netfilter]# insmod ip_tables.ko
[root@zclinux netfilter]# insmod iptable_filter.ko
#lsmod | grep ip #查看下是否导入成功
iptable_filter 2793 0
ip_tables 17895 1 ipt这回我先执行stop
/etc/init.d/iptables stop
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]good 关闭正常，看到ok瞬间清爽，在开启！
/etc/init.d/iptables start
iptables: Applying firewall rules: iptables-restore v1.4.7: iptables-restore: unable to initialize table 'filter'
Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
一千万至羊驼从身边踏过！
再来，先看下防火墙状态是否是关闭
/etc/init.d/iptables status
iptables: Firewall is not running.
ok 已经不显示模块加载失败了，成功仅在咫尺
lsmod | grep ip #查看下模块还在吗
ipv6 337436 30 再来一遍
[root@zclinux netfilter]# insmod ip_tables.ko
[root@zclinux netfilter]# insmod iptable_filter.ko
[root@zclinux netfilter]# lsmod | grep ip
iptable_filter 2793 0
ip_tables 17895 1 iptable_filter
ipv6 337436 30
加载成功！
启动防火墙！
[root@zclinux netfilter]# /etc/init.d/iptables start
iptables: Applying firewall rules: [ OK ]启动防火墙成功！！！！
查看下策略咋样
[root@zclinux netfilter]# iptables -vnL
Chain INPUT (policy ACCEPT 295 packets, 34096 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 270 packets, 41311 bytes)
pkts bytes target prot opt in out source destination 忘了把策略加进去了，再来
[root@zclinux netfilter]# /etc/init.d/iptables stop
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ][root@zclinux netfilter]# /etc/init.d/iptables start
iptables: Applying firewall rules: iptables-restore v1.4.7: iptables-restore: unable to initialize table 'filter'
Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]再来一遍
[root@zclinux netfilter]# lsmod | grep ip
ipv6 337436 30
[root@zclinux netfilter]# insmod ip_tables.ko
[root@zclinux netfilter]# insmod iptable_filter.ko
[root@zclinux netfilter]# lsmod | grep ip
iptable_filter 2793 0
ip_tables 17895 1 iptable_filter
ipv6 337436 30
[root@zclinux netfilter]# /etc/init.d/iptables start
iptables: Applying firewall rules: [ OK ]
[root@zclinux netfilter]# iptables -vnL
哈哈哈哈哈 规则回来了，都在抓紧写个脚本进行检测
[root@zclinux ~]# vi checkiptables_module.sh
#!/bin/bash
DATE=`date '+%Y-%m-%d %H:%M:%S' `
check=`lsmod | grep ip | grep iptable | awk -F" " '{print $4}'| grep ip`
if [ "$check" -eq 'iptable_filter' ]
then
echo $DATE "- iptables is ok ! " >>/tmp/iptables_check.log
else
/etc/init.d/iptables stop
cd /lib/modules/`uname -r`/kernel/net/ipv4/netfilter;
insmod ip_tables.ko;
insmod iptable_filter.ko;
/etc/init.d/iptables start;
echo $DATE "-iptables is restore ! " >> /tmp/iptables_check.log
fi
chmod +x /root/checkiptables_module.sh
把脚本加如到执行计划中
crontab -e
* */1 * * * /root/checkiptables_module.sh收官，不知道为啥，这个防火墙内核只能这样了，文中所有涉及到服务器的真实信息已被打码修改。
------------------------------分割线---------------------------------------------------------
环境centos7.3
问题： 出现iptables -vnL
iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
和上述问题一直，但细节部分有点不同
还是调用内核模块
lsmod | grep ip发现里面没有任何显示，这就证明iptables的几个内核有问题
尝试手动加载内核
modprobe ip_tables
modprobe ip_tables输入完成后，再次查看，还是没有任何内核关于iptables的模块被加载
执行全部内核加载命令：
depmod -a但是突然报错：
#depmod -a
depmod: ERROR: could not open directory /lib/modules/3.10.0-514.el7.x86_64: No such file or directory
depmod: FATAL: could not search modules: No such file or directory
提示找不到文件
这句很重要，找不到文件的话，就无法加载内核
手动查找下
find / -name 3.10.0-514.el7.x86_64
/usr/lib/modules/3.10.0-514.el7.x86_64
只有这个下面有一个，手动复制一份到/lib下
cp -r /lib/ /lib.bak/
cp -r /usr/lib/* /lib/再次执行
depmod -a执行成功
查看模块加载情况：
lsmod | grep ip手动添加
modprobe ip_tables
modprobe ip_tables再次查看添加成功
lsmod | grep ip
iptable_filter 12810 0
ip_tables 27115 1 iptable_filteriptables -vnL正常
在没加载模块之前，防火墙重启后，持续报这个错误：
systemctl restart iptables
Job for iptables.service failed because the control process exited with error code. See "systemctl status iptables.service" and "journalctl -xe" for details.
查看状态后：
systemctl status iptables
? iptables.service - IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Tue 2019-01-08 12:33:38 ICT; 38s ago
Process: 2959 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=1/FAILURE)
Main PID: 2959 (code=exited, status=1/FAILURE)
Jan 08 12:33:38 manager systemd[1]: Starting IPv4 firewall with iptables...
Jan 08 12:33:38 manager iptables.init[2959]: iptables: Applying firewall rules: iptables-restore v1.4.21: iptabl...lter'
Jan 08 12:33:38 manager iptables.init[2959]: Error occurred at line: 4
Jan 08 12:33:38 manager iptables.init[2959]: Try `iptables-restore -h' or 'iptables-restore --help' for more inf...tion.
Jan 08 12:33:38 manager iptables.init[2959]: [FAILED]
Jan 08 12:33:38 manager systemd[1]: iptables.service: main process exited, code=exited, status=1/FAILURE
Jan 08 12:33:38 manager systemd[1]: Failed to start IPv4 firewall with iptables.
Jan 08 12:33:38 manager systemd[1]: Unit iptables.service entered failed state.
Jan 08 12:33:38 manager systemd[1]: iptables.service failed.
Hint: Some lines were ellipsized, use -l to show in full.
[root@manager ~]# lsmod | grep ipta
[root@manager ~]# lsmod | grep ip
[root@manager ~]# depmod -a
depmod: ERROR: could not open directory /lib/modules/3.10.0-514.el7.x86_64: No such file or directory
depmod: FATAL: could not search modules: No such file or directory
网上很多都说是由于firewalld服务造成的，于是关闭firewalld
systemctl stop firewalld
sysetmctl disable firewalld
但重启还是报错，这个不是问题的根本
于是尝试上述的加载内核成功后，重启iptables，启动也成功
定位问题要快准狠，多看日志多看报错
总结下还是/lib路径下的文件有产生变化，和/usr/lib下的文件不同步造成，手动复制到/lib下，正常启动