iptables says your kernel needs upgrading. Upgrading the kernel is what broke it.
TL;DR : On Raspberry Pi's 6.18 kernel line, ip_tables.ko , iptable_nat.ko and iptable_filter.ko are not built. This is deliberate — legacy iptables was deprecated in favour of nftables. But CONFIG_IP_NF_IPTABLES=m is still set in the shipped kernel config, because the symbol that actually builds the legacy modules is now the separately-named CONFIG_IP_NF_IPTABLES_LEGACY , and that one is unset.…
The Raspberry Pi's kernel on the 6.18 kernel line does not include the ip_tables.ko, iptable_nat.ko, and iptable_filter.ko modules. This is intentional, as legacy iptables has been deprecated in favor of nftables. However, the CONFIG_IP_NF_IPTABLES=m symbol is still set in the shipped kernel configuration, because the module builds are now controlled by CONFIG_IP_NF_IPTABLES_LEGACY, which is unset.
Consequently, the config appears to promise a module that does not exist, and the error message indicates that you should upgrade the kernel you just upgraded. This issue affects systems running WireGuard containers, Docker setups, or Waydroid installations that rely on legacy iptables. The problem lies in the kernel configuration, not a packaging bug, and upgrading the kernel exacerbates the issue.
The error suggests two dead-end solutions, neither of which addresses the root cause. The missing modules are nf_tables-related, and the kernel's module directory contains 17 legacy ipt_* files. The CONFIG_IP_NF_IPTABLES_LEGACY symbol builds the legacy modules, while CONFIG_IP_NF_IPTABLES now selects the nftables-backed path. Upstream confirmed this change in February 2026.
Not everyone experiences this issue, as stock Raspberry Pi OS Lite installs or default Docker setups do not rely on legacy iptables.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
