<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Package: iptables</p>
<p>Version: 1.8.2-4<br>
</p>
<p><br>
</p>
<p>Hi,</p>
<p><br>
</p>
<p>there is a bug in iptables-nft 1.8.2-4 in Debian buster:</p>
<pre style="box-sizing: border-box; font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 11.9px; margin-top: 0px; margin-bottom: 0px !important; overflow-wrap: normal; padding: 16px; overflow: auto; line-height: 1.45; background-color: rgb(246, 248, 250); border-radius: 3px; color: rgb(36, 41, 46); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-color: initial;"><code style="box-sizing: border-box; font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 11.9px; padding: 0px; margin: 0px; background: initial; border-radius: 3px; word-break: normal; white-space: pre; border: 0px; display: inline; overflow: visible; line-height: inherit; overflow-wrap: normal;"># lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 10 (buster)
Release: 10
Codename: buster
# dpkg -s iptables | grep ^Version
Version: 1.8.2-4
# iptables-nft -N FOO
# iptables-nft -A FOO -m comment --comment "kubernetes firewall for dropping marked packets" -m mark --mark 0x8000 -j DROP
# iptables-nft -C FOO -m comment --comment "kubernetes firewall for dropping marked packets" -m mark --mark 0x8000 -j DROP && echo exists
iptables: Bad rule (does a matching rule exist in that chain?).
# iptables-legacy -N BAR
# iptables-legacy -A BAR -m comment --comment "kubernetes firewall for dropping marked packets" -m mark --mark 0x8000 -j DROP
# iptables-legacy -C BAR -m comment --comment "kubernetes firewall for dropping marked packets" -m mark --mark 0x8000 -j DROP && echo exists
exists</code></pre>
<p><br>
</p>
<p>We filed the original issue here: <a
href="https://github.com/kubernetes/kubernetes/issues/82361#issue-489594945">https://github.com/kubernetes/kubernetes/issues/82361#issue-489594945</a></p>
<p><br>
</p>
<p>Best,<br>
Wolfgang<br>
</p>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
Wolfgang Jentner
Department of Computer and Information Science
Chair for Data Analysis and Visualization
University of Konstanz
Box 78
D-78457 Konstanz, Germany
Mail: <a class="moz-txt-link-abbreviated" href="mailto:jentner@dbvis.inf.uni-konstanz.de">jentner@dbvis.inf.uni-konstanz.de</a>
Web: <a class="moz-txt-link-freetext" href="https://www.vis.uni-konstanz.de/mitglieder/jentner/">https://www.vis.uni-konstanz.de/mitglieder/jentner/</a>
Phone: +49 (0) 7531 88 3941
Fax: +49 (0) 7531 88 3065
Room: C201</pre>
</body>
</html>