I’m having a problem with my Incus container setup on a Raspberry Pi 4. I’m trying to attach an ACL to a container, but it’s failing to start with an error in the logs. The ACL itself is empty.
Here’s my setup:
Host: Raspberry Pi 4
OS: Latest Raspberry Pi OS (Debian)
Incus: Version 6.15-ui-0.18
Problem: The container won’t start after attaching an ACL. The interesting thing is that this works without any issues on a different machine running Debian. This makes me think it might be a problem specific to the Raspberry Pi environment or its kernel.
Here is the exact error from the logs:
Failed to start device "eth1":
Failed adding bridge filter rules for instance device "container-1.eth1"
(bridge): Failed apply nftables config: Failed to run: nft -f -: exit
status 1 (/dev/stdin:28:2-9: Error: Could not process rule: Protocol
error
ct state established,related accept
^^^^^^^^
/dev/stdin:75:2-9: Error: Could not process rule: Protocol error
ct state established,related accept
^^^^^^^^
/dev/stdin:107:2-9: Error: Could not process rule: Protocol error
ct state established,related accept
^^^^^^^^)
The error messages about ct state established,related accept seem to be the key, but I’m not sure what is causing it.
Has anyone else experienced a similar problem when running Incus on a Raspberry Pi? Any ideas on what might be causing this Protocol error or how to fix it?
From what I can find online, some of the nft features are not built within the rpi kernel, so that may be the issue. All the Google hits for “nft Protocol Error” talk about rpi so it’s probably not a coincidence
grep -i nft /boot/config-6.12.34+rpt-rpi-v8
CONFIG_NFT_NUMGEN=m
CONFIG_NFT_CT=m
CONFIG_NFT_FLOW_OFFLOAD=m
CONFIG_NFT_CONNLIMIT=m
CONFIG_NFT_LOG=m
CONFIG_NFT_LIMIT=m
CONFIG_NFT_MASQ=m
CONFIG_NFT_REDIR=m
CONFIG_NFT_NAT=m
CONFIG_NFT_TUNNEL=m
CONFIG_NFT_QUEUE=m
CONFIG_NFT_QUOTA=m
CONFIG_NFT_REJECT=m
CONFIG_NFT_REJECT_INET=m
CONFIG_NFT_COMPAT=m
CONFIG_NFT_HASH=m
CONFIG_NFT_FIB=m
CONFIG_NFT_FIB_INET=m
CONFIG_NFT_XFRM=m
CONFIG_NFT_SOCKET=m
CONFIG_NFT_OSF=m
CONFIG_NFT_TPROXY=m
CONFIG_NFT_SYNPROXY=m
CONFIG_NFT_DUP_NETDEV=m
CONFIG_NFT_FWD_NETDEV=m
CONFIG_NFT_FIB_NETDEV=m
# CONFIG_NFT_REJECT_NETDEV is not set
CONFIG_NFT_REJECT_IPV4=m
CONFIG_NFT_DUP_IPV4=m
CONFIG_NFT_FIB_IPV4=m
CONFIG_NFT_COMPAT_ARP=m
CONFIG_NFT_REJECT_IPV6=m
CONFIG_NFT_DUP_IPV6=m
CONFIG_NFT_FIB_IPV6=m
# CONFIG_NFT_BRIDGE_META is not set
CONFIG_NFT_BRIDGE_REJECT=m
# CONFIG_NFTL is not set
# CONFIG_INFTL is not set
The ACL on nftables with bridged networks likely relies on the NFT_BRIDGE_META stuff.
Given that just two of the options are disabled, that seems like an oversight in the rpi kernel, so you may want to report a bug over there asking for CONFIG_NFT_REJECT_NETDEV and CONFIG_NFT_BRIDGE_META to be enabled as modules, aligning them with the rest of the nft stuff.
Since it’s said that every Linux user eventually ends up compiling the kernel, I decided to give it a try. I followed the official Raspberry Pi documentation and modified the auto-generated .config file by uncommenting the nftables options we discussed.
I compiled the kernel, installed it, and booted it up, but unfortunately, the error is still there. I did the same with the 6.16 branch and got the same result.
Well, the Raspberry Pi kernel compilation and installation procedure doesn’t automatically copy the configuration file to /boot/. So, the /boot/config-XYZ file simply doesn’t exist.
I can only confirm that I’ve enabled the necessary options in the .config file before compiling. I’ll continue to play around with the NETFILTER settings, as a few of them are also disabled.
ubuntu@rpi-compile:~/linux16/linux$ cat .config | grep -i NETFILTER | grep '#'
# Core Netfilter Configuration
# CONFIG_NETFILTER_NETLINK_HOOK is not set
# CONFIG_NETFILTER_NETLINK_GLUE_CT is not set
# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set
# CONFIG_NETFILTER_XT_MATCH_CGROUP is not set
# CONFIG_NETFILTER_XT_MATCH_IPCOMP is not set
