2

I am building a custom embedded Linux platform based on the NXP i.MX8 with Yocto. I want to use UFW to setup the firewall. When I boot the system and try to use UFW it returns an error

Couldn't determine iptables version. 

I have the iptables and nftables packages installed. I have tried to manually change the itpables symlink to point to the iptables-legacy binary. It still fails. How can I fix this? Please see the versions below.

    root@iot-gate-imx8plus:~# iptables -v
    iptables v1.8.7 (legacy): no command specified
    Try `iptables -h' or 'iptables --help' for more information.
    root@iot-gate-imx8plus:~# nft -v
    nftables v1.0.2 (Lester Gooch)
    root@iot-gate-imx8plus:~# ufw version
    ufw 0.36.2
    Copyright 2008-2023 Canonical Ltd.
    root@iot-gate-imx8plus:~# ufw status
    ERROR: Couldn't determine iptables version
    root@iot-gate-imx8plus:~# uname -r
    5.15.32+g07c574e56d60
    root@iot-gate-imx8plus:~#

iptables:

    root@iot-gate-imx8plus:/usr/sbin# ls -lrt *iptables*

>    lrwxrwxrwx 1 root root 20 Mar  9  2018 iptables-save -> xtables-legacy-multi\
    lrwxrwxrwx 1 root root 20 Mar  9  2018 iptables-restore -> xtables-legacy-multi\
    lrwxrwxrwx 1 root root 20 Mar  9  2018 iptables-legacy-save -> xtables-legacy-multi\
    lrwxrwxrwx 1 root root 20 Mar  9  2018 iptables-legacy-restore -> xtables-legacy-multi\
    lrwxrwxrwx 1 root root 20 Mar  9  2018 iptables-legacy -> xtables-legacy-multi\
    lrwxrwxrwx 1 root root 20 Mar  9  2018 iptables -> xtables-legacy-multi
    

UPDATE:

Strace pointed out the problem. UFW makes an assumption of where the iptables binary is and Yocto installed it somewhere else:

strace: Process 700 attached
[pid   700] openat(AT_FDCWD, "/proc/self/fd", O_RDONLY|O_CLOEXEC) = 3
[pid   700] execve("/sbin/iptables", ["/sbin/iptables", "-V"], 0xffffec437b88 /* 21 vars */) = -1 ENOENT (No such file or directory)
[pid   700] +++ exited with 255 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=700, si_uid=0, si_status=255, si_utime=0, si_stime=0} ---
ERROR: Couldn't determine iptables version
+++ exited with 1 +++
root@iot-gate-imx8plus:~# which iptables
/usr/sbin/iptables
root@iot-gate-imx8plus:~# ln -sf /usr/sbin/iptables /sbin/iptables
root@iot-gate-imx8plus:~# ufw status
Status: inactive
2
  • Can you share on a pastebin the output of strace -f -s 1000 -e trace=file ufw status ? Aug 22, 2023 at 1:31
  • You helped me figure it out - thank you. If you want to write an answer I will accept it and allocate the bounty.
    – PhilBot
    Aug 22, 2023 at 17:43

1 Answer 1

2
+150

You could use strace -f -s 1000 -e trace=file ufw status to figure out which files path are used, you could discover something wrong.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .