So I'm trying to get Vuurmuur installed on a headless linux box that I've been using as a home router. So far, I've been using iptables but wanted to switch to using something more convenient/easier to use.


I'm running:

Ubuntu 16.04.3 LTS Xenial
4.4.0-97-generic #120-Ubuntu SMP Tue Sep 19 17:28:18 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux


Vuurmuur doesn't have a debian package maintainer so I added this entry to my apt sources:

deb ftp://ftp.vuurmuur.org/ubuntu/ raring main

Do an apt-get update, install vuurmuur and things look ok BUT when I try to run vuurmuur this happens:

# vuurmuur
Error: checking for iptables-capabilities failed. Please see error.log.

I checked the documentation here: https://www.vuurmuur.org/trac/wiki/Faq and that suggests that iptables or conntrack is not setup correctly

For completeness, this is the error in the error log:

01/04/2018 13:57:18 : PID 1866  : vuurmuur      : Error (-1): no connection tracking support in the kernel (in: check_iptcaps:402).

I did a lsmod for iptables and conntrack and they both seem to be there:

# lsmod | egrep "iptable|conntr"
nf_conntrack_netlink    40960  0
nfnetlink              16384  2 nf_conntrack_netlink,nfnetlink_queue
iptable_mangle         16384  0
xt_conntrack           16384  2
iptable_filter         16384  1
iptable_nat            16384  1
nf_conntrack_ipv4      16384  3
nf_defrag_ipv4         16384  1 nf_conntrack_ipv4
nf_nat_ipv4            16384  1 iptable_nat
nf_conntrack          106496  9 xt_helper,nf_nat,xt_state,nf_nat_ipv4,xt_conntrack,nf_nat_masquerade_ipv4,nf_conntrack_netlink,xt_connmark,nf_conntrack_ipv4
ip_tables              24576  3 iptable_filter,iptable_mangle,iptable_nat
x_tables               36864  20 xt_mark,xt_helper,xt_length,ip_tables,xt_tcpudp,ipt_MASQUERADE,xt_NFQUEUE,xt_limit,xt_state,xt_conntrack,xt_LOG,xt_mac,xt_nat,iptable_filter,xt_CLASSIFY,xt_TCPMSS,xt_connmark,ipt_REJECT,xt_REDIRECT,iptable_mangle


I've seen some other posts that the way conntrack is enabled has changed in the past so I'm wondering if between Raring and Xenial, the method to check for iptables/conntrack changed but vuurmuur hasn't been updated yet.

Thanks, Alex


So turns out their are two options:

Option 1

Run the vuurmuur command with the below option:


Option 2 (what I did)

Use the 0.8rc5 version from the Vuurmuur website and I was able to start Vuurmuur.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.