iptables: Permission denied (you must be root)

Permission denied (you must be root) means iptables could not open the kernel's netfilter interface because the calling process lacks the CAP_NET_ADMIN capability. Run it as root (sudo iptables ...). Inside a container, root is not enough: the container needs the NET_ADMIN capability (docker run --cap-add=NET_ADMIN).

What it looks like

The prefix depends on the iptables version and backend. With the nf_tables backend (the default on current Debian, Ubuntu, Fedora and RHEL):

iptables v1.8.7 (nf_tables): Could not fetch rule set generation id: Permission denied (you must be root)

With the legacy backend:

iptables v1.8.7 (legacy): can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.

The second line of the legacy message is generic advice; with this error, the cause is missing privileges, not an old kernel. The exit status is 4 with nf_tables (a "resource problem" in iptables' terms) and 3 with legacy.

Fixes

sudo iptables -L -n -v              # normal Linux host
sudo ip6tables -L -n -v             # IPv6 rules need it too

Containers:

docker run --rm --cap-add=NET_ADMIN alpine sh -c 'apk add -q iptables && iptables -L -n'

# Kubernetes container spec
securityContext:
  capabilities:
    add: ["NET_ADMIN"]

--cap-add=NET_ADMIN gives the container control over its own network namespace only, which is usually what a VPN client or a test firewall needs; --privileged grants far more and is rarely necessary.

Check what you have

id -u                         # 0 means root
grep CapEff /proc/self/status # effective capabilities as a hex mask
capsh --decode=$(awk '/CapEff/ {print $2}' /proc/self/status) | tr ',' '\n' | grep net_admin

If cap_net_admin is missing from the decoded list, iptables will fail with this message even as UID 0.