Knowledgebase

Overview

ConfigServer Security & Firewall (CSF) operates using the iptables interface. When upgrading to Debian 11, Ubuntu 20.04 LTS, or Ubuntu 22.04 LTS, the operating system defaults to nftables. To maintain CSF compatibility, you must configure the system to use iptables-nft, which acts as a bridge to the underlying nftables kernel API and infrastructure.

Prerequisites

• Root or sudo access to the server
• Apt package manager available

Verify Current iptables Variant

Modern Linux distributions provide two variants of the iptables command:

1. nf_tables (iptables-nft): Recommended. Provides a compatibility layer for nftables.
2. legacy (iptables-legacy): Deprecated and not recommended for newer kernels.

Confirm which variant is currently active by checking the iptables version. The output will indicate (nf_tables) if the recommended bridge is in use:

# iptables -V
iptables v1.8.4 (nf_tables)

Configure System Alternatives

If the system is not using iptables-nft, configure the alternatives manager to switch variants:

1. Execute the following command to view available options:

# update-alternatives --config iptables
There are 2 choices for the alternative iptables (providing /usr/sbin/iptables).

  Selection    Path                       Priority   Status
------------------------------------------------------------
* 0            /usr/sbin/iptables-nft      20        auto mode
  1            /usr/sbin/iptables-legacy   10        manual mode
  2            /usr/sbin/iptables-nft      20        manual mode

Press <enter> to keep the current choice[*], or type selection number: 

2. Select option 2 (or the corresponding number for /usr/sbin/iptables-nft) and press Enter.

Update Symbolic Links

Re-link the symbolic links to ensure all iptables utilities point to the correct alternatives directory:

ln -s /etc/alternatives/iptables /sbin/iptables 2>/dev/null
ln -s /etc/alternatives/iptables-save /sbin/iptables-save 2>/dev/null
ln -s /etc/alternatives/iptables-restore /sbin/iptables-restore 2>/dev/null
ln -s /etc/alternatives/ip6tables /sbin/ip6tables 2>/dev/null
ln -s /etc/alternatives/ip6tables-save /sbin/ip6tables-save 2>/dev/null
ln -s /etc/alternatives/ip6tables-restore /sbin/ip6tables-restore 2>/dev/null

Apply Configuration in Juggernaut Firewall

Finalize the configuration within the control panel:

1. Navigate to Juggernaut Firewall > Settings > Binary Settings.
2. Click the default button at the bottom of the page to apply the correct iptables binary paths.

Troubleshooting

If CSF fails to start or reports missing binaries after completing these steps:

• Verify that iptables-nft is active by running # iptables -V. The output must include (nf_tables).
• Ensure the symbolic links were created successfully without errors.
• Restart the CSF service after applying changes in Juggernaut Firewall to load the updated binary paths.