1

Trying to use cgroup module in iptables rule cause "No chain/target/match by that name" message.

I'm using:

Linux raspberrypi 4.19.42-v7+ #1219 SMP Tue May 14 21:20:58 BST 2019 armv7l GNU/Linux

running on Raspberry Pi 3B+. What I'm trying to do is to set the iptables rule like this:

iptables -t mangle -A OUTPUT -m cgroup --cgroup 0x00110011 -j MARK --set-mark 10

And it give me the error: iptables: No chain/target/match by that name.

What I've already tied:

  • iptables -m cgroup -h - gives me the help about available cgroup options.
  • when I'm trying to type -m anystring it gives me message iptables v1.6.0: Couldn't load match anystring so cgroup must be there
  • modprobe cls-cgroup - gives no error message
  • /sys/fs/cgroup/net_cls - exist and I can assign PIDs to the tasks in it

While trying to add all other rules to mangle output, even with other modules, they are accepted. No matter what I will try, all is good as long as I try -m cgroup.

What am I doing wrong?

Improve this question
4
  • 2
    Seems you have used rpi-update and are using a potentially unstable kernel. Try again with stock Rasbian Stretch
    – Dirk
    May 17, 2019 at 18:31
  • It is unlikely that you will find someone that will help you with an unsupported experimental kernel. You can test it and tell us and the developers the result.
    – Ingo
    May 18, 2019 at 9:45
  • Did you ever solve this problem? I'm currently dealing with the same problem, but I can't really find anything about it except for this question.
    – jangxx
    Sep 28, 2020 at 22:34
  • Net filters (nftables) is newer and easier to use.
    – ctrl-alt-delor
    Oct 2, 2022 at 15:07

1 Answer 1

Reset to default
0

You are using an experimental kernel and presumably firmware, probably from running rpi-update. There are outstanding issues with the 4.19 kernel.

"In normal circumstances there is NEVER a need to run rpi-update as it always gets you to the leading edge firmware and kernel and because that may be a testing version it could leave your RPi unbootable". https://www.raspberrypi.org/forums/viewtopic.php?p=916911#p916911 Even the rpi-update documentation now warns "Even on Raspbian you should only use this with a good reason. This gets you the latest bleeding edge kernel/firmware."

sudo apt-get update; sudo apt-get install --reinstall raspberrypi-bootloader raspberrypi-kernel will put it back to the latest supported kernel/bootcode.

Improve this answer
2
  • I know I'm on experimental kernel. I decided to make this move after I saw that it fixes one issue I had running on 4.14 and yes, moving to 4.19 fixed my problem. Then I ran rpi-update recently. Few days ago I wanted to make some changes with network settings and I needed to use cgroup for the first time and had the problem from my main question. OK, I've done what you said to revert kernel, it reinstalled correctly, then I restarted my device but when I wrote uname -a it still show exactly the same version as before and cgroup in iptables still don't work :(
    – N1ghtwish
    May 19, 2019 at 13:21
  • I just dig into github and found this link It seems that the experimental version just moved to the stable. That's why my reinstall takes no effect. It seems the only thing that left for me is to report this issue with iptables and cgroup here link and just wait.
    – N1ghtwish
    May 19, 2019 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.