<div dir="ltr"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif;font-size:small">You are right. My kernel was not updated. Sorry about that and happy new year. How can I close this bug?</div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><font size="4"><b><u><br></u></b></font></div><div dir="ltr"><font size="4"><b><u>Patrik</u></b></font><div><font size="1"><a href="https://patrikx3.com" target="_blank">WWW</a> | <a href="https://github.com/patrikx3/" target="_blank">GitHub</a> | <a href="https://www.npmjs.com/~patrikx3" target="_blank">NPM</a> | <a href="https://corifeus.com" target="_blank">Corifeus</a> | +</font><span style="font-size:x-small">36 20 342 8046</span></div><div><br><br></div></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr">On Sun, Dec 30, 2018 at 7:33 PM Jamie Strandboge <<a href="mailto:jamie@canonical.com">jamie@canonical.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">reassign 915627 iptables<br>
tags 915627 +confirmed<br>
thanks<br>
<br>
Your kernel is too old. Ie, I cannot reproduce this with the current 4.19<br>
kernel:<br>
<br>
$ lsb_release -a<br>
No LSB modules are available.<br>
Distributor ID: Debian<br>
Description: Debian GNU/Linux buster/sid<br>
Release: unstable<br>
Codename: sid<br>
<br>
$ cat /proc/version<br>
Linux version 4.19.0-1-amd64 (<a href="mailto:debian-kernel@lists.debian.org" target="_blank">debian-kernel@lists.debian.org</a>) (gcc version 8.2.0 (Debian 8.2.0-13)) #1 SMP Debian 4.19.12-1 (2018-12-22)<br>
<br>
$ sudo iptables --version<br>
iptables v1.8.2 (nf_tables)<br>
<br>
$ sudo apt-get install ufw<br>
...<br>
The following NEW packages will be installed:<br>
ufw<br>
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.<br>
Need to get 164 kB of archives.<br>
After this operation, 852 kB of additional disk space will be used.<br>
Get:1 <a href="http://ftp.us.debian.org/debian" rel="noreferrer" target="_blank">http://ftp.us.debian.org/debian</a> sid/main amd64 ufw all 0.36-1 [164 kB]<br>
...<br>
<br>
$ sudo /usr/share/ufw/check-requirements<br>
Has python: pass (binary: python2.7, version: 2.7.15+, py2)<br>
Has iptables: pass<br>
Has ip6tables: pass<br>
<br>
Has /proc/net/dev: pass<br>
Has /proc/net/if_inet6: pass<br>
<br>
This script will now attempt to create various rules using the iptables<br>
and ip6tables commands. This may result in module autoloading (eg, for<br>
IPv6).<br>
Proceed with checks (Y/n)? y<br>
== IPv4 ==<br>
...<br>
== IPv6 ==<br>
Creating 'ufw-check-requirements6'... done<br>
...<br>
icmpv6 (destination-unreachable): pass<br>
icmpv6 (packet-too-big): pass<br>
icmpv6 (time-exceeded): pass<br>
icmpv6 (parameter-problem): pass<br>
icmpv6 (echo-request): pass<br>
icmpv6 with hl (neighbor-solicitation): pass<br>
icmpv6 with hl (neighbor-advertisement): pass<br>
icmpv6 with hl (router-solicitation): pass<br>
icmpv6 with hl (router-advertisement): pass<br>
ipv6 rt: pass<br>
<br>
All tests passed<br>
<br>
<br>
All ufw is doing in check-requirements is:<br>
# ip6tables -N ufw-check-requirements6<br>
# ip6tables -I ufw-check-requirements6 -j RETURN<br>
# ip6tables -A ufw-check-requirements6 -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT<br>
<br>
Which all succeed here. However, your kernel is 4.15.0-2, which corresponds to:<br>
<br>
<a href="http://snapshot.debian.org/package/linux/4.15.11-1/" rel="noreferrer" target="_blank">http://snapshot.debian.org/package/linux/4.15.11-1/</a><br>
<br>
This kernel is more than 9 months old and I recommend you upgrade it for<br>
security fixes alone. For testing this bug, I installed it and rebooted:<br>
<br>
$ cat /proc/version<br>
Linux version 4.15.0-2-amd64 (<a href="mailto:debian-kernel@lists.debian.org" target="_blank">debian-kernel@lists.debian.org</a>) (gcc version 7.3.0 (Debian 7.3.0-12)) #1 SMP Debian 4.15.11-1 (2018-03-20)<br>
<br>
and indeed, the tests fail like you see. Reduced test case:<br>
<br>
$ sudo ip6tables -N ufw-check-requirements6<br>
$ sudo ip6tables -I ufw-check-requirements6 -j RETURN<br>
$ sudo ip6tables -A ufw-check-requirements6 -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT<br>
ip6tables v1.8.2 (nf_tables): unknown option "--icmpv6-type"<br>
Try `ip6tables -h' or 'ip6tables --help' for more information.<br>
<br>
If I use Arturo's test case, ip6tables-nft fails on this kernel as well:<br>
<br>
$ sudo ip6tables-nft -A FORWARD -i eth0 -p icmpv6 -m icmpv6 --icmpv6-type no-route<br>
ip6tables v1.8.2 (nf_tables): Couldn't load match `icmp6':No such file or directory<br>
<br>
Try `ip6tables -h' or 'ip6tables --help' for more information.<br>
$ sudo ip6tables-legacy -A FORWARD -i eth0 -p icmpv6 -m icmpv6 --icmpv6-type no-route<br>
$<br>
<br>
This is not a bug in ufw. Please upgrade your kernel and this will start to<br>
work.<br>
<br>
This may be considered a bug in iptables, so reassigning to there for now.<br>
Seems either iptables 1.8 has kernel version requirements that need to be<br>
expressed in iptables' Debian packaging or iptables nft needs to be updated to<br>
work with older kernels.<br>
<br>
-- <br>
Jamie Strandboge | <a href="http://www.canonical.com" rel="noreferrer" target="_blank">http://www.canonical.com</a><br>
</blockquote></div>