[BUG] Unable to install iptables modules (DS1815+)

[mrchris2000]

Describe the bug
When running the install script everything worked except the iptables element, I ran that again seperately and I get this output:
Kernel Version: 3.10.108
Platform: avoton

• .ko files in place ? 🟢
• kernel modules loaded ? 🔴
• available for download ? 🟢
• CM script loads modules ?grep: /var/packages/ContainerManager/scripts/start-stop-status: No such file or directory
  🔴

Installing and validating the kernel modules...
./install_iptables_modules.sh: line 129: 22705 Killed insmod ${MODULES_FOLDER}/${IP4MODULE}

This led to containers not being able to be created due to:
Unable to enable DIRECT ACCESS FILTERING - DROP rule: (iptables failed: iptables --wait -t raw -A PREROUTING -d 172.17.0.2 ! -i docker0 -j DROP: iptables v1.8.3 (legacy): can't initialize iptables table raw': Table does not exist (do you need to insmod?)

So I created this config:
more /etc/systemd/system/docker.service.d/override.conf
[Service]
Environment="DOCKER_INSECURE_NO_IPTABLES_RAW=1"

To reproduce
sudo ./install_iptables_modules.sh

Docker daemon configuration

cat: /var/packages/ContainerManager/etc/dockerd.json: No such file or directory

Additional context
Update Docker Engine and Docker Compose on Synology to target version

Current DSM version: 7.1.1
Current Docker version: 29.4.0
Current Docker Compose version: 5.1.2
Current containerd version: 2.2.2
Current runc version: 1.3.5

[telnetdoogie]

This is because your version of docker is still called "Docker" on DSM 7.1.1 so the path is different.
What DSM version are you running? and on what device?

I see you're on avoton and the 'latest' version of that. You might need to manually update to the latest DSM for your NAS.

In the meantime if you uninstall and re-install ContainerManager from the package center you should be back to where you started.

If you wanted to make a quick fix, you could replace the line:

FILE="/var/packages/ContainerManager/scripts/start-stop-status" in install_iptables_modules.sh with:
FILE="/var/packages/Docker/scripts/start-stop-status"

...however, my strong recommendation would be instead of retrofitting the script to an old version of ContainerManager, bring your ContainerManager (DSM) up to a newer version and running the update once that's done.

[telnetdoogie]

I just made an [untested] modification / quick fix for this. If you do a git pull on the update repo, you should get an updated version of install_iptables_modules.sh if you want to try it.

But my advice would STILL be to update to the latest version of ContainerManager and DSM.

[telnetdoogie]

Looks like you're stuck at 7.1.1

Latest Release should fix this. git pull and Give it a try.
If you're OK with no iptables and things are working, you can just keep truckin' with your override, if it's working for you.

[mrchris2000]

I saw on another thread you don't have a synology device any more so thanks for the best efforts on this.
Unfortunately that just moved the same error to a different line number :)

Installing and validating the kernel modules...
./install_iptables_modules.sh: line 137:  7262 Killed                  insmod ${MODULES_FOLDER}/${IP4MODULE}

I wouldn't mind but the RAW config is also not working:

docker: Error response from daemon: failed to set up container networking: failed to create endpoint n8nio-n8n1 on network bridge: Unable to enable DIRECT ACCESS FILTERING - DROP rule:  (iptables failed: iptables --wait -t raw -A PREROUTING -d 172.17.0.2 ! -i docker0 -j DROP: iptables v1.8.3 (legacy): can't initialize iptables table `raw': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
 (exit status 3))

All this because Synology won't ship updated DSM versions for my older NAS... I understand software support is a cost to them, but its frustrating at this end too.

[mrchris2000]

Looks like the override was in the wrong place, I added it to:
/etc/systemd/system/pkg-Docker-dockerd.service.d/override.conf
and that worked.

[telnetdoogie]

You should be able to edit the dockerd.json file as well for that same property?

[telnetdoogie]

Apologies @mrchris2000 and @gerstemann - I saw @mrchris2000's output regarding the start-stop script and thought this was his main issue.

The issue you're seeing in this and #65 is that the avoton module built for 3.1.108 is not working on this kernel. I will remove it from the download location to avoid confusion. I was waiting for a user to confirm whether it worked; it obviously doesn't.

If anyone wants to attempt to build the iptables_raw kernel modules for 3.1.108 I would encourage you to clone https://github.com/telnetdoogie/synology-kernelmodules and experiment with build options and toolkit versions to try to get a working copy of these modules. In the meantime, @mrchris2000 's override for adding DOCKER_INSECURE_NO_IPTABLES_RAW=1 (this should also be able to be added to the dockerd.json file should 'alleviate' but not solve the core issue.

If you add the override or modify the dockerd.json to bypass iptables_raw, you can run the update script with --skip-iptables

[github-actions]

This issue has been marked as stale and will be closed if no further activity occurs.