6

In a fresh installation of CenotOS 6 in a VPS after running sysctl -p /etc/sysctl.conf I got this errors:

error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
error: "net.bridge.bridge-nf-call-iptables" is an unknown key
error: "net.bridge.bridge-nf-call-arptables" is an unknown key

What is the starting point to solving this errors?

Improve this question
1
  • 1
    Are they really a problem - I have the same errors on a CentOS 6 system which appears to work fine.
    – user9517
    Feb 11, 2013 at 18:09

5 Answers 5

Reset to default
3

You mention in your question that you are using a VPS. What kind of VPS? It sounds like you are in a OpenVZ VPS. If it is OpenVZ, it is sharing the kernel among many containers like yours and you cannot change the kernel configuration per container but directly on the host. I actually build a litlle OpenVZ centos container and I tried to apply the kernel config net.bridge.bridge-nf-call-ip6tables = 0 followed by sysctl -p and I got the same error as you do. If you really need it, that means you may have to think about changing the type of virtualization you are using or you may try to contact your VPS provider and ask him to enable this setting.

Best.

Improve this answer
2
  • I just try tuning my VPS and during the process I got this error, I don't know what are them. and if removing those line is a safe way to remove errors, I will do.
    – Mohammad Ali Akbari
    Feb 11, 2013 at 20:39
  • 1
    It is not about removing these line they were in my VPS configuration too, but if you want them to be applied, if you are running on a OpenVZ virtualization, you have to ask the owner of the server to activate these settings on the host not on the container. Best.
    – drivard
    Feb 12, 2013 at 21:27
6

Try:

modprobe bridge
lsmod | grep bridge

You don't the those modules loaded into the kernel.

Improve this answer
2
  • What is this module? should I load it? My server works fine with this errors without loading this module.
    – Mohammad Ali Akbari
    Feb 11, 2013 at 18:38
  • If you don't need the bridge, you can just ignore the entries/warnings
    – Tiffany Walker
    Feb 11, 2013 at 19:36
6

There are several bugreports about this on Red Hat Bugzilla, for example here, here and here.

Just remove the lines or run sysctl -e -p instead of sysctl -p.

Improve this answer
3

You get the errors because you do not have the bridge kernel module loaded. Three choices:

  1. Load the module if you need it
  2. Comment those lines out from /etc/sysctl.conf
  3. Let sysctl ignore the errors by giving it the -e flag.
Improve this answer
1
  • 1
    The problem I have had is that those entries are present in /etc/sysctl.conf even when the bridge module isn't loaded, which it isn't by default. Probably added by the rpm installed. I have a puppet module which removes those entries so we don't get the errors anymore.
    – lsd
    Feb 11, 2013 at 18:30
0

This has been fixed in a redhat errata:RHBA-2015:1289 (Possibly paywall).

In summary - the fix is to move the configuration from sysctl.conf to modprobe.d/dist.conf:

Delete the offending lines from /etc/sysctl.conf 

sed -i '/net.bridge.bridge-nf-call-/d' /etc/sysctl.conf

And add the behavior to your /etc/modprobe.d/dist.conf

cat <<EOF>>/etc/modprobe.d/dist.conf

# Disable netfilter on bridges when the bridge module is loaded
install bridge /sbin/modprobe --ignore-install bridge && /sbin/sysctl -q -w net.bridge.bridge-nf-call-arptables=0 net.bridge.bridge-nf-call-iptables=0 net.bridge.bridge-nf-call-ip6tables=0
EOF

Which will set the values correctly upon load of the bridge module, or simply update your rpms to versions 

module-init-tools-3.9-25.el6  
initscripts-9.03.53-1.el6

Both are present by default in RHEL 6.8

If anyone is interested in the history behind this, it's present here with an explanation there.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .