Andy Piper<p>I updated my Framework 13 to Fedora 42 about two weeks ago, just before the final release. It has been pretty solid!</p><p>This evening, I went to start up my VPN (I use NordVPN, FWIW). No luck. Just no connection.</p><pre><code>The VPN connection has failed. Please check your internet connection and try connecting to the VPN again. If the issue persists, contact our customer support.</code></pre><p>Well, thanks.</p><p>In case it was a package issue, I uninstalled and reinstalled the third party <code>nordvpn</code> RPM. No luck, same error.</p><p>Digging into the system log, I found this:</p><pre><code>19:40:46 [Error] failed to connect to uk2646.nordvpn.com : resseting forward firewall: reseting allowlist rules: removing allowlisted subnets: listing iptables rules: exec: "iptables": executable file not found in $PATH</code></pre><p>A “smoking gun”! </p><p>OK, so let’s dig a bit more.</p><pre><code>$ journalctl -g iptables -b --no-pagerApr 28 19:47:20 neshatan tailscaled[1649]: linuxfw: clear iptables: exec: "iptables": executable file not found in $PATHApr 28 19:47:20 neshatan tailscaled[1649]: router: iptables not found: firewall mode "iptables" not supported: iptables command run fail: multiple errors:Apr 28 19:47:20 neshatan tailscaled[1649]: exec: "iptables": executable file not found in $PATHApr 28 19:48:56 neshatan nordvpnd[1518]: 2025/04/28 19:48:56 [Error] failed to connect to uk2582.nordvpn.com : resseting forward firewall: reseting allowlist rules: removing allowlisted subnets: listing iptables rules: exec: "iptables": executable file not found in $PATHApr 28 19:49:22 neshatan nordvpnd[1518]: 2025/04/28 19:49:22 [Error] failed to connect to uk1910.nordvpn.com : unsetting allowlist: disabling allowlist routing: clearing allowlisting: iptables listing rules: exec: "iptables": executable file not found in $PATH:Apr 28 19:50:28 neshatan nordvpnd[1518]: 2025/04/28 19:50:28 [Error] failed to connect to uk2281.nordvpn.com : unsetting allowlist: disabling allowlist routing: clearing allowlisting: iptables listing rules: exec: "iptables": executable file not found in $PATH:Apr 28 19:53:36 neshatan nordvpnd[16192]: 2025/04/28 19:53:36 [Error] failed to connect to uk2570.nordvpn.com : resseting forward firewall: reseting allowlist rules: removing allowlisted subnets: listing iptables rules: exec: "iptables": executable file not found in $PATHApr 28 19:57:28 neshatan nordvpnd[16192]: 2025/04/28 19:57:28 [Error] failed to connect to uk2123.nordvpn.com : unsetting allowlist: disabling allowlist routing: clearing allowlisting: iptables listing rules: exec: "iptables": executable file not found in $PATH:</code></pre><p>OK, so we definitely don’t have an <code>iptables</code> executable.</p><p>It turns out that there is an <code>iptables-nft</code> package installed (for netfilter), and this is <em>supposed</em> to install <code>/usr/bin/iptables</code> – but that file doesn’t exist.</p><p>A quick symlink of <code>iptables-nft</code> as <code>iptables</code> was a basic patch for this, and I was able to bring the VPN connection up again.</p><p>Two related reports from the interwebs, one from as recent as today (which may explain why I only just encountered it) – I found these just as I started to write this post.</p><ul><li><a href="https://www.reddit.com/r/Fedora/comments/1k9tvbh/latest_upgrade_of_iptablesnft_and_iptableslibs/" rel="nofollow noopener noreferrer" target="_blank">Latest update of iptables-nft breaks NordVPN</a></li><li><a href="https://www.reddit.com/r/Windscribe/comments/1k0wts4/connection_problem_on_fedora_42/" rel="nofollow noopener noreferrer" target="_blank">Connection problem on Fedora 42</a></li></ul> <p>I’ll take the opportunity of this blog post to point out that <code>nordvpnd</code> has two typos in log messages. I’m not entirely certain where else to report this issue. Consider resetting these.</p><p>In the meantime, I also accidentally discovered that <code>tailscaled</code> had also been reporting issues with a missing <code>iptables</code> executable. I hadn’t noticed too many issues with it over the past couple of weeks, but hopefully this is an improvement for both daemons!</p> <p><strong>Update 2024/04/30</strong> – as pointed out by some folks in Fediverse comments, this appears to have been an issue with an update to the <code>iptables-nft</code> package on Fedora interacting poorly with <code>alternatives</code> and the merger of <code>/usr/bin</code> and <code>/usr/sbin</code>, and has been resolved for the moment by reverting the change 👍</p><p></p><p><a href="https://andypiper.co.uk/2025/04/28/nordvpn-fedora-42-and-iptables-compatibility/" class="" rel="nofollow noopener noreferrer" target="_blank">https://andypiper.co.uk/2025/04/28/nordvpn-fedora-42-and-iptables-compatibility/</a></p><p><a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://andypiper.co.uk/tag/100daystooffload/" target="_blank">#100DaysToOffload</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://andypiper.co.uk/tag/computing/" target="_blank">#Computing</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://andypiper.co.uk/tag/fedora/" target="_blank">#Fedora</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://andypiper.co.uk/tag/iptables/" target="_blank">#iptables</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://andypiper.co.uk/tag/linux/" target="_blank">#Linux</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://andypiper.co.uk/tag/networking/" target="_blank">#networking</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://andypiper.co.uk/tag/nordvpn/" target="_blank">#nordVPN</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://andypiper.co.uk/tag/tailscale/" target="_blank">#tailscale</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://andypiper.co.uk/tag/technology/" target="_blank">#Technology</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://andypiper.co.uk/tag/vpn/" target="_blank">#VPN</a></p>