nftables missing essential kernel modules

mowglie

the title says it all. Solus Linux kernels are missing kernel modules essential to successfully operating nftables! is this an oversight? or is there some other reason they don't compile their kernels with:

nf_tables_inet
nf_tables_ipv6
nf_tables_ipv4

those 3 modules dictate what families your chains belong to. you cant even enter a chain without them. if you do, you get the dreaded & equally vague "Error: Could not process rule: Operation not supported" result. arrgh! so frustrating! such a great distro in every other way thus far, superior in many ways even, but compiling kernels just for this? no thanks, the inferiority of iptables is less pain than that of compiling kernels.

does anyone know if I just failed to install some pkg or if there is any way to remedy this without compiling kernels from source? & yes, I've hunted online for weeks to no avail, which also shocks me b/c how can I be the 1st person to run face-first into this wall? (unfortunate pun) Solus & nftables have been around for years, so I hope I am overlooking some basic, simple solution.

DataDrake

mowglie nftables was originally included for firewalld. It's unlikely that they have been extensively tested since nftables were quite new back then and we haven't had a maintainer for either package in quite some time. It looks like I actually added nftables to the repo in December 2018 in order to update firewalld for someone, but that's as far as it has gone. The base modules are installed in the kernel and no one has pointed out anything missing until now. No one on the team uses firewalld (UFW is enough for what I need) so it has basically only seen updates when it conflicted with other package upgrades. Any of the testing that was done for firewalld doesn't appear to have touched nftables for one reason or another.

CONFIG_NF_TABLES=m
# CONFIG_NF_TABLES_SET is not set
# CONFIG_NF_TABLES_INET is not set
# CONFIG_NF_TABLES_NETDEV is not set

You are welcome to file a bug requesting that we enable these modules (I will forget without one): https://dev.getsol.us/

mowglie

DataDrake you got it, i will file. & it makes sense how this occurred, albeit by disclosing some unfortunate things about the user base (perhaps intended). thanks for your thorough & clear reply.

DataDrake

mowglie Not sure I see how not using firewalld is somehow unfortunate. Many users want a firewall that is easily configured from a GUI interface. gufw and ufw fit that bill just fine. Solus users are just normal people going about their lives. Not everyone has time to sit down and learn the complexities of firewalld.

mowglie

DataDrake what? I meant it is unfortunate that the user base is either so small or nontechnical or perhaps just disinterested that my nftables issues did not arise earlier. & I am def far from technical, so that realization is unfortunate. I don't find anything unfortunate w/ ppl not using or using whatever they want. communication: it's hard! 😉

mowglie

DataDrake btw I don't use firewalld either; I didn't even know what it is until you mentioned it.

DataDrake

mowglie It's more that

albeit by disclosing some unfortunate things about the user base (perhaps intended)

might come off a bit offensive to some folk, especially when followed up by:

I meant it is unfortunate that the user base is either so small or nontechnical or perhaps just disinterested that my nftables issues did not arise earlier.

There's nothing unfortunate about it all. People from all levels of skill and knowledge use Linux. If anything, I'm proud to say that we have users who are able to install Solus and use it without much knowledge of Linux. This means we have succeeded in making Solus easy to use and approachable, bringing new people to Linux in the process.