iptables fails to start on first boot with EL10
Maintainers usually reply within 1 day
@cmd-ntrf is already working on this.
Since Aug 19, 2026.
- #593 by @cmd-ntrf — closed without merging
Assessment
This issue has not been assessed yet.
Description
On first boot of the puppet server, during the bootstrap phase, we create the iptables firewall rules for the puppet server to avoid agents being unable to communicate with the server when applying their catalog for the first time.
In EL10, to run iptables, we have to install kernel modules that are no longer built-in, via the package kernel-modules-extra. During the bootstrap phase, the package is installed, but the modules are not loaded until next boot. Therefore iptables fails to start, and we get the following error message in /var/log/cloud-init-output.log:
systemd[1]: Starting iptables.service - IPv4 firewall with iptables...
iptables.init[33697]: iptables: Applying firewall rules:
iptables.init[33703]: Warning: Extension state revision 0 not supported, missing kernel module?
iptables.init[33703]: Warning: Extension state is not supported, missing kernel module?
iptables.init[33703]: Warning: Extension tcp revision 0 not supported, missing kernel module?
iptables.init[33703]: Warning: Extension REJECT revision 0 not supported, missing kernel module?
iptables.init[33703]: iptables-restore v1.8.11 (nf_tables):
iptables.init[33703]: line 8: RULE_APPEND failed (No such file or directory): rule in chain INPUT
iptables.init[33703]: line 11: RULE_APPEND failed (No such file or directory): rule in chain INPUT
iptables.init[33703]: line 12: RULE_APPEND failed (No such file or directory): rule in chain INPUT
iptables.init[33703]: line 13: RULE_APPEND failed (No such file or directory): rule in chain FORWARD
iptables.init[33697]: [FAILED]
systemd[1]: iptables.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: iptables.service: Failed with result 'exit-code'.
systemd[1]: Failed to start iptables.service - IPv4 firewall with iptables.
We thought of loading the missing kernel modules, but the package kernel-modules-extra is provided only for the latest kernel version, which is most often not the kernel version running on first boot.
A solution would be to drop iptables, and replace it with nftables instead. https://github.com/voxpupuli/puppet-nftables
- Dominant language
- Puppet
- Stars
- 16
- Forks
- 31
- Avg merge
- 11h 9m
- Merged PRs (30d)
- 21
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ComputeCanada/puppet-magic_castle
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
ComputeCanada/puppet-magic_castle#634 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
ComputeCanada/puppet-magic_castle#606 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 46/100
ComputeCanada/puppet-magic_castle#602 · 1 comment ·
Maintainers usually reply within 1 day
-
enhancement help wanted
Difficulty 4/5 3-5 days Newbie friendliness 25/100
ComputeCanada/puppet-magic_castle#476 · 1 comment ·
Maintainers usually reply within 1 day
-
Test and debug GPUs with Incus containersMay be free again @etiennedub claimed this 354 days ago, and no pull request is open. Openenhancement hardware help wanted
ComputeCanada/puppet-magic_castle#469 · 1 assignee ·
Maintainers usually reply within 1 day