# Possible bug in iptables module

**URL:** <https://forum.ansible.com/t/possible-bug-in-iptables-module/23731>\
**Category:** Ansible Project\
**Created:** [February 14, 2017, 7:54pm UTC](https://forum.ansible.com/t/possible-bug-in-iptables-module/23731 "2017-02-14T19:54:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Juan\_Pablo\_Genovese](https://avatars.discourse-cdn.com/v4/letter/j/ac8455/32.png) [@Juan\_Pablo\_Genovese](https://forum.ansible.com/u/Juan_Pablo_Genovese)\
**Post date:** [February 14, 2017, 7:54pm UTC](https://forum.ansible.com/t/possible-bug-in-iptables-module/23731/1 "2017-02-14T19:54:51Z")

</div>

Hello everybody!

I’m having problems with the iptables module trying to execute this task:

- iptables:  
chain: INPUT  
match: conntrack  
ctstate: ESTABLISHED,RELATED  
jump: ACCEPT

This leads to this error:

TASK [iptables] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
fatal: [default]: FAILED! =\> {“changed”: false, “cmd”: “/sbin/iptables -t filter -A INPUT -m conntrack -j ACCEPT -m state --state ESTABLISHED,RELATED”, “failed”: true, “msg”: “iptables v1.4.21: conntrack: At least one option is required\nTry `iptables -h' or 'iptables --help' for more information.", "rc": 2, "stderr": "iptables v1.4.21: conntrack: At least one option is required\nTry `iptables -h’ or ‘iptables --help’ for more information.\n”, “stdout”: “”, “stdout\_lines”: }

Did anyone hit this issue and have a solution? If not I can submit a bug report.

Thank you!

---

<div class="post-metadata">

**Author:** ![Nehal\_J\_Wani](https://avatars.discourse-cdn.com/v4/letter/n/a9a28c/32.png) [@Nehal\_J\_Wani](https://forum.ansible.com/u/Nehal_J_Wani)\
**Post date:** [February 15, 2017, 1:02pm UTC](https://forum.ansible.com/t/possible-bug-in-iptables-module/23731/2 "2017-02-15T13:02:49Z")

</div>

Seems like a bug to me.

Technically, the conntrack match supersedes - and so obsoletes - the  
state match. But practically the state match is not obsoleted in any  
way.

The ansible iptables module is doing:

/sbin/iptables -t filter -A INPUT -m conntrack -j ACCEPT -m state  
--state ESTABLISHED,RELATED

So, there is no argument passed to the conntrack match. Ideally, it  
should have been:

/sbin/iptables -t filter -A INPUT -m conntrack -j ACCEPT --ctstate  
ESTABLISHED,RELATED

For now it seems that you can get around this problem by  
removing/commenting 'match: conntrack' and then the module will  
produce:

/sbin/iptables -t filter -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED

---

<div class="post-metadata">

**Author:** ![Juan\_Pablo\_Genovese](https://avatars.discourse-cdn.com/v4/letter/j/ac8455/32.png) [@Juan\_Pablo\_Genovese](https://forum.ansible.com/u/Juan_Pablo_Genovese)\
**Post date:** [February 15, 2017, 2:53pm UTC](https://forum.ansible.com/t/possible-bug-in-iptables-module/23731/3 "2017-02-15T14:53:18Z")

</div>

Right!

Ok, so I just filed an issue in the Ansible repo: [https://github.com/ansible/ansible/issues/21467](https://github.com/ansible/ansible/issues/21467)

Thanks for the feedback, Nehal!