Program does not start (Could not open socket to kernel: Address family not supported by protocol)

[jorik392]

I have installed the program using aur and it installs but the service does not start running. systemd load state is loaded but active state shows forever as activating and unit state is auto-restart.

systemd log shows some errors
ERROR: path=/usr/bin/ip6tables args=[-D INPUT --protocol udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass] err=exit status 1 out='Could not open socket to kernel: Address family not supported by protocol

ERROR: path=/usr/bin/iptables args=[-D OUTPUT -m mark --mark 101285 -j DROP] err=exit status 1 out='iptables: Bad rule (does a matching rule exist in that chain?).

ERROR: path=/usr/bin/iptables args=[-D OUTPUT -t mangle -m conntrack --ctstate NEW -j NFQUEUE --queue-num 0 --queue-bypass] err=exit status 1 out='iptables: No chain/target/match by that name.

opensnitchd.service: Main process exited, code=exited, status=1/FAILURE
opensnitchd.service: Failed with result 'exit-code'.

I went through wiki and still could not get it running. Kernel is 5.4.

[gustavo-iniguez-goya]

Hi jorik392!

Could you launch it from a shell as root and post the output?

For example:
# /usr/bin/opensnitchd -rules-path /etc/opensnitchd/rules/ -debug -process-monitor-method proc -ui-socket unix:///tmp/osui.sock

thank you!

[jorik392]

Output

ERROR: path=/usr/bin/ip6tables args=[-D INPUT --protocol udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass] err=exit status 1 out='Could not open socket to kernel: Address family not supported by protocol
'
ERROR: path=/usr/bin/iptables args=[-D OUTPUT -t mangle -m conntrack --ctstate NEW -j NFQUEUE --queue-num 0 --queue-bypass] err=exit status 1 out='iptables: No chain/target/match by that name.
'
ERROR: path=/usr/bin/iptables args=[-D OUTPUT -m mark --mark 101285 -j DROP] err=exit status 1 out='iptables: Bad rule (does a matching rule exist in that chain?).
'
IMP Starting opensnitch-daemon v1.0.0
INF Loading rules from /etc/opensnitchd/rules ...
DBG Starting 16 workers ...
DBG Worker #4 started.
OK: libnetfiler_queue supports nfq_get_uid
DBG Rules watcher started on path /etc/opensnitchd/rules ...
DBG Worker #14 started.
DBG Stats worker #3 started.
DBG Worker #0 started.
DBG Worker #3 started.
DBG Worker #9 started.
ERROR: path=/usr/bin/ip6tables args=[-I INPUT --protocol udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass] err=exit status 1 out='Could not open socket to kernel: Address family not supported by protocol
'
!!! Error while running DNS firewall rule: exit status 1

[gustavo-iniguez-goya]

woah, on the one hand, we shouldn't exit if we cannot insert an ip6tables rule. I'll fix it ASAP.

But on the other hand, the error suggests that your kernel does not support IPV6 protocol, can you post the output of the following command?
grep CONFIG_IPV6= /boot/config-$(uname -r)

or execute: ip6tables -L

[jorik392]

Running ip6tables -L

ip6tables v1.8.5 (legacy): can't initialize ip6tables table `filter': Address family not supported by protocol
Perhaps ip6tables or your kernel needs to be upgraded.

[gustavo-iniguez-goya]

ok, thank you jorik392, I'll fix it soon.

[jorik392]

Thanks @gustavo-iniguez-goya, I tried latest commit and it looks like it is working now. Are there more fixes needed or should I close the issue?

I have a few questions about the program if you could answer

1. which process monitor method is the best? are there good and bad for each one?
2. why is intercept unknown connections option disabled? is it better to enable?
3. what does default action/duration do in the Nodes settings tab?

[gustavo-iniguez-goya]

yes, you can close the issue.

1. which process monitor method is the best? are there good and bad for each one?

audit is more accurate than the others two. proc works just fine in my opinion, and I haven't used ftrace in ages.

2. why is intercept unknown connections option disabled? is it better to enable?

The option is disabled by default because in some cases it generates a lot of popup dialogs to allow/deny connections. In my case for example, when coming back from hibernate and connecting to the network (but it has been mostly solved in v1.0.1). It's a bit annoying sometimes.

The option to intercept "unknown" connections was added to alert the user about connections that doesn't have an associated PID. That situation may occur due to several reasons:

1. opensnitch has been unable to find the PID (due to multiple reasons).
2. the outgoing connection is in reality a FORWARD connection that is traversing the box.

Activate it and see if it works for you.

3. what does default action/duration do in the Nodes settings tab?

That's the default action of the daemon. For example, if the GUI is not running and a new outgoing connection is about to be established, the default action will be applied. Or if you decide to uncheck the Intercept Unknown connections, those connections won't be displayed to the user and the default action of the daemon is applied.

[jorik392]

Thanks for the answers.

By more accurate do you mean audit provides more accurate information about connection or that it can intercept more connections generally?

[gustavo-iniguez-goya]

I mean that there're more chances to get the process (PID) that created the connection.