Firewalld Won't Start Due to Netfilter Issue

Question

Firewalld won't start, and when executing 'systemctl status firewalld', I get the following errors:

    ERROR: Failed to read file "/proc/sys/net/netfilter/nf_conntrack_helper": [Errno 2] No such file or directory: '/proc/sys/net/netfilter/nf_conntrack_helper'
    WARNING: Failed to get and parse nf_conntrack_helper setting
    WARNING: iptables not usable, disabling IPv4 firewall.
    WARNING: ip6tables not usable, disabling IPv6 firewall.
    WARNING: ebtables not usable, disabling ethernet bridge firewall.
    FATAL ERROR: No IPv4 and IPv6 firewall.
    ERROR: Raising SystemExit in run_server

Directory /proc/sys/net/netfilter/ has only nf_log in it. It must have something to do with the problem as I can see more directories there on my other servers.

I've tried removing and reinstalling both firewalld and iptables so far with no luck. libnetfilter_conntrack is also installed according to yum.

Any suggestions?

System is CentOS 7 3.10.0-327.4.5.el7.x86_64

Not sure what type of virtualization is used for digital ocean droplets.. could be kvm, xen, openvz, lxc, lxd etc... but you can ask them since you pay for the service... so I would start with that... — Bogdan Stoica, Nov 27 '17 at 16:47
Confirmed. They use KVM: https://www.digitalocean.com/help/technical/general/ — James S., Nov 27 '17 at 17:10
It appears not be loaded or installed. Or at least I don't see it files in `/lib/modules/3.10.0-693.11.1.el7.x86_64/kernel/net/netfilter` directory. How can it be installed/loaded? — James S., Dec 10 '17 at 01:47
How you installed firewalld? I tried to install on my CentOS 7.4.1708, and everything working ok. — Alexander Tolkachev, Dec 20 '17 at 21:36

score 4 · Answer 1 · answered Nov 27 '17 at 17:25

4

Tey reinstalling the kernel and iptables and then reboot the server: yum reinstall kernel iptables

answered Nov 27 '17 at 17:25

Bogdan Stoica

403
4
9

Done. Didn't help.. Any other ideas? – James S. Nov 27 '17 at 17:50
No clue, I do not have that file either but iptables works just fine.... if you do a `lsmod | grep ipt`, do you get anything? you should have the iptables_filter module loaded in the kernel... – Bogdan Stoica Nov 28 '17 at 13:45
I don't get anything. In fact I get many less modules returned with `lsmod` command in general compared to other server. In particular `nf_conntrack` is missing as well which appears to be a dependency. How can they be loaded/installed? – James S. Dec 10 '17 at 01:50

Firewalld Won't Start Due to Netfilter Issue

1 Answers1