Skip to content
Browse

/errors/ufw/couldnt-determine-iptables-version

ERROR: Couldn't determine iptables version

The commands on this page have not been executed by our verification runner yet.updated
tool
ufw
exit code
1
versions
ufw 0.36, ufw 0.36.2
os
linux

ERROR: Couldn't determine iptables version means ufw ran iptables -V to find out which iptables it is working with, and the command failed. The iptables binary is missing, or the iptables link points to something that cannot run. Install the iptables package and make sure iptables -V prints a version; on Debian and Ubuntu also check the update-alternatives link.

Where the message comes from

When ufw starts, its backend (src/backend.py) calls ufw.util.get_iptables_version(), which runs iptables -V from ufw's iptables directory (/usr/sbin on Debian and Ubuntu builds) and takes the version from the second word of the output. A non-zero exit status (or a binary that cannot be started) raises an error, which ufw reports as ERROR: Couldn't determine iptables version, and ufw exits with status 1. The check runs while ufw initialises its backend, so every command that uses the backend fails the same way, including ufw status.

Check iptables

bash
iptables -V
ls -l /usr/sbin/iptables
update-alternatives --display iptables

A working system prints a line like iptables v1.8.x (nf_tables) or (legacy). If the binary is missing, install it (Debian, Ubuntu: apt-get install iptables; run as root). If the alternative points to a missing file, select an installed one:

bash
update-alternatives --config iptables
update-alternatives --config ip6tables

Use the same backend (nft or legacy) for both, and the one the rest of the system uses (Docker, Kubernetes), so that all tools see the same rules.

In Docker, LXC and WSL

Minimal container images usually do not include iptables, and an unprivileged container cannot change the firewall even when it is installed. Configure the firewall on the host, or for Docker use published ports and Docker's own DOCKER-USER chain on the host. Under WSL 2, firewall rules for Windows applications belong in Windows Defender Firewall, not in ufw inside the Linux distribution.

Sources

Related pages

errors · ufwERROR: problem running ufw-initufw-init failed to load the rules with iptables-restore, often after an edit to before.rules. Read the lines after the error and test files with --test.errors · ufwufw: ERROR: You need to be root to run this scriptufw refuses to run without root, even for ufw status. Use sudo, check the user in scripts, or allow one user to run only /usr/sbin/ufw through a sudoers rule.errors · iptablesiptables: Permission denied (you must be root)iptables needs root or CAP_NET_ADMIN to read or change rules. Run it with sudo; in Docker or Kubernetes add the NET_ADMIN capability, not privileged mode.compare · iptablesiptables vs nftables: differences and migrationnftables replaces iptables, ip6tables, arptables and ebtables with one tool, nft, one syntax and atomic updates; iptables-nft keeps iptables commands working.