# Enable nftables in firecracker default 5.10 kernel config

**URL:** https://forum.opennebula.io/t/enable-nftables-in-firecracker-default-5-10-kernel-config/11985
**Category:** Product Support
**Created:** [March 25, 2024, 1:09pm UTC](https://forum.opennebula.io/t/enable-nftables-in-firecracker-default-5-10-kernel-config/11985 "2024-03-25T13:09:11Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Derek\_Northcote1](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/derek_northcote1/32/7812_2.png) [@Derek\_Northcote1](https://forum.opennebula.io/u/Derek_Northcote1)
#### Post date: [March 25, 2024, 1:09pm UTC](https://forum.opennebula.io/t/enable-nftables-in-firecracker-default-5-10-kernel-config/11985/1 "2024-03-25T13:09:11Z")

</div>

## Is it possible to build the firecracker kernel from the supplied firecracker 5.1.0 kernel config with nftables installed and enabled in the kernel. As I understand it module loading is not supported so nftables needs to be “baked in” at the kernel compilation level.

**Versions of the related components and OS (frontend, hypervisors, VMs):**

Opennebula 6.8.1  
VM Ubuntu 22.04  
nftables latest

**Steps to reproduce:**

Start microvm with nftables installed

**Current results:**

 ![image](https://canada1.discourse-cdn.com/flex031/uploads/opennebula/original/2X/0/0f68d0a76b46d2884d96cd7db14d5574451f2ff2.png)

**Expected results:**

nft output

---

<div class="post-metadata">

### Author: ![Derek\_Northcote1](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/derek_northcote1/32/7812_2.png) [@Derek\_Northcote1](https://forum.opennebula.io/u/Derek_Northcote1)
#### Post date: [March 28, 2024, 11:15am UTC](https://forum.opennebula.io/t/enable-nftables-in-firecracker-default-5-10-kernel-config/11985/2 "2024-03-28T11:15:04Z")

</div>

[SOLVED]

All that was required was to insert the following directives into the **guest\_config** and compile using **./resources/rebuild.sh**

CONFIG\_NETFILTER=y  
CONFIG\_NETFILTER\_ADVANCED=y  
CONFIG\_BRIDGE\_NETFILTER=m  
CONFIG\_NETFILTER\_INGRESS=y  
CONFIG\_NETFILTER\_NETLINK=y  
CONFIG\_NETFILTER\_NETLINK\_ACCT=m  
CONFIG\_NETFILTER\_NETLINK\_QUEUE=m  
CONFIG\_NETFILTER\_NETLINK\_LOG=m  
CONFIG\_NETFILTER\_NETLINK\_GLUE\_CT=y  
CONFIG\_NETFILTER\_SYNPROXY=m  
CONFIG\_NETFILTER\_XTABLES=y  
CONFIG\_NETFILTER\_XT\_MARK=m  
CONFIG\_NETFILTER\_XT\_CONNMARK=m  
CONFIG\_NETFILTER\_XT\_SET=m  
CONFIG\_NETFILTER\_XT\_TARGET\_CHECKSUM=m  
CONFIG\_NETFILTER\_XT\_TARGET\_CLASSIFY=m  
CONFIG\_NETFILTER\_XT\_TARGET\_CONNMARK=m  
CONFIG\_NETFILTER\_XT\_TARGET\_CT=m  
CONFIG\_NETFILTER\_XT\_TARGET\_DSCP=m  
CONFIG\_NETFILTER\_XT\_TARGET\_HL=m  
CONFIG\_NETFILTER\_XT\_TARGET\_HMARK=m  
CONFIG\_NETFILTER\_XT\_TARGET\_IDLETIMER=m  
CONFIG\_NETFILTER\_XT\_TARGET\_LED=m  
CONFIG\_NETFILTER\_XT\_TARGET\_LOG=m  
CONFIG\_NETFILTER\_XT\_TARGET\_MARK=m  
CONFIG\_NETFILTER\_XT\_NAT=m  
CONFIG\_NETFILTER\_XT\_TARGET\_NETMAP=m  
CONFIG\_NETFILTER\_INGRESS=y  
CONFIG\_NETFILTER\_NETLINK=y  
CONFIG\_NETFILTER\_NETLINK\_ACCT=m  
CONFIG\_NETFILTER\_NETLINK\_QUEUE=m  
CONFIG\_NETFILTER\_NETLINK\_LOG=m  
CONFIG\_NETFILTER\_NETLINK\_GLUE\_CT=y  
CONFIG\_NETFILTER\_SYNPROXY=m  
CONFIG\_NETFILTER\_XTABLES=y  
CONFIG\_NETFILTER\_XT\_MARK=m  
CONFIG\_NETFILTER\_XT\_CONNMARK=m  
CONFIG\_NETFILTER\_XT\_SET=m  
CONFIG\_NETFILTER\_XT\_TARGET\_CHECKSUM=m  
CONFIG\_NETFILTER\_XT\_MATCH\_L2TP=m  
CONFIG\_NETFILTER\_XT\_MATCH\_LENGTH=m  
CONFIG\_NETFILTER\_XT\_MATCH\_LIMIT=m  
CONFIG\_NETFILTER\_XT\_MATCH\_MAC=m  
CONFIG\_NETFILTER\_XT\_MATCH\_MARK=m  
CONFIG\_NETFILTER\_XT\_MATCH\_MULTIPORT=m  
CONFIG\_NETFILTER\_XT\_MATCH\_NFACCT=m  
CONFIG\_NETFILTER\_XT\_MATCH\_OSF=m  
CONFIG\_NETFILTER\_XT\_MATCH\_OWNER=m  
CONFIG\_NETFILTER\_XT\_MATCH\_POLICY=m  
CONFIG\_NETFILTER\_XT\_MATCH\_PHYSDEV=m  
CONFIG\_NETFILTER\_XT\_MATCH\_PKTTYPE=m  
CONFIG\_NETFILTER\_XT\_MATCH\_QUOTA=m  
CONFIG\_NETFILTER\_XT\_MATCH\_QUOTA2=m  
CONFIG\_NETFILTER\_XT\_MATCH\_QUOTA2\_LOG=y  
CONFIG\_NETFILTER\_XT\_MATCH\_RATEEST=m  
CONFIG\_NETFILTER\_XT\_MATCH\_REALM=m  
CONFIG\_NETFILTER\_XT\_MATCH\_RECENT=m  
CONFIG\_NETFILTER\_XT\_MATCH\_SCTP=m  
CONFIG\_NETFILTER\_XT\_MATCH\_SOCKET=m  
CONFIG\_NETFILTER\_XT\_MATCH\_STATE=m  
CONFIG\_NETFILTER\_XT\_MATCH\_STATISTIC=m  
CONFIG\_NETFILTER\_XT\_MATCH\_STRING=m  
CONFIG\_NETFILTER\_XT\_MATCH\_TCPMSS=m  
CONFIG\_NETFILTER\_XT\_MATCH\_TIME=m  
CONFIG\_NETFILTER\_XT\_MATCH\_U32=m

Also ensure that an init.sh script is included in the /context/files section

ie:

_#!/bin/bash_  
_apt install libnftnl11 libmnl0 libgmp10 libreadline8 -y_  
_apt install nftables iptables_ -y\*

 ![image](https://canada1.discourse-cdn.com/flex031/uploads/opennebula/original/2X/8/83bca39eb497b045eef0f963bc5d227c82134ae1.png)