<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Alpine 3.19: iptables: Bad rule (does a matching rule exist in that chain?)."
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1757">1757</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Alpine 3.19: iptables: Bad rule (does a matching rule exist in that chain?).
</td>
</tr>
<tr>
<th>Product</th>
<td>iptables
</td>
</tr>
<tr>
<th>Version</th>
<td>1.8.x
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>other
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>iptables
</td>
</tr>
<tr>
<th>Assignee</th>
<td>netfilter-buglog@lists.netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>quentin.mcgaw@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>On Alpine Linux 3.19, after adding and removing rules, it doesn't find a rule
that was added previously. To reproduce:
docker run -it --rm --cap-add=NET_ADMIN alpine:3.19
apk add iptables
iptables --policy FORWARD ACCEPT
iptables --append INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables --append INPUT -i lo -j ACCEPT
iptables --append OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables --append OUTPUT -o eth0 -s 1.2.3.4 -d 5.6.7.8 -j ACCEPT
iptables --append OUTPUT -o eth0 -s 1.2.3.4 -d 5.6.7.8 -j ACCEPT
iptables --append OUTPUT -o eth0 -s 1.2.3.4 -d 5.6.7.8 -j ACCEPT
iptables --append OUTPUT -o eth0 -s 1.2.3.4 -d 5.6.7.8 -j ACCEPT
iptables --append OUTPUT -o eth0 -s 1.2.3.4 -d 5.6.7.8 -j ACCEPT
iptables --append INPUT -i eth0 -p tcp --dport 12345 -j ACCEPT
iptables --append INPUT -i eth0 -p udp --dport 12345 -j ACCEPT
iptables --delete INPUT -i eth0 -p tcp --dport 12345 -j ACCEPT
And this will produce "iptables: Bad rule (does a matching rule exist in that
chain?)". This issue seems to be resolved with Alpine 3.20 although iptables
version didn't change (1.8.3), so my guess is this is a nftables kernel issue.
We did fallback on using the iptables legacy to not use nftables for the time
being, but we will try again nftables using alpine 3.20 now that it is
released.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>