Module ip_tables not found

[OliverGuy]

The latest image doesn't seem to work on Arch Linux 6.19.11-arch1-1:

$ docker run -it \
    --rm \
    --sysctl="net.ipv4.conf.all.src_valid_mark=1" \
    --privileged=true \
    -p 8112:8112 \
    -p 58846:58846 \
    -p 58946:58946 \
    -p 58946:58946/udp \
    --name=delugevpn \
    -v /etc/localtime:/etc/localtime:ro \
    -v "$HOME"/Downloads/Deluge/:/data \
    -v "$HOME"/Apps/DelugeVPN/config/:/config \
    -e PGID=$(id -g deluge) \
    -e VPN_ENABLED=yes \
    -e VPN_PROV=custom \
    -e VPN_CLIENT=wireguard \
    -e DELUGE_ENABLE_WEBUI_PASSWORD=yes \
    -e USERSPACE_WIREGUARD=no \
    -e DEBUG=false \
    -e LAN_NETWORK=192.168.1.0/24 \
    binhex/arch-delugevpn

Created by...
___.   .__       .__
\_ |__ |__| ____ |  |__   ____ ___  ___
 | __ \|  |/    \|  |  \_/ __ \\  \/  /
 | \_\ \  |   |  \   Y  \  ___/ >    <
 |___  /__|___|  /___|  /\___  >__/\_ \
     \/        \/     \/     \/      \/
   https://hub.docker.com/u/binhex/

2026-04-11 16:23:36.632356 [info] System information: Linux 294404f4b9b3 6.19.11-arch1-1 #1 SMP PREEMPT_DYNAMIC Thu, 02 Apr 2026 23:33:01 +0000 x86_64 GNU/Linux
2026-04-11 16:23:36.648160 [info] Application name: 'delugevpn'
2026-04-11 16:23:36.664616 [info] Base image release tag: '2025072801'
2026-04-11 16:23:36.680677 [info] Output image release tag: '2.2.0-1-04'
2026-04-11 16:23:36.697656 [warn] PUID not defined (via -e PUID), defaulting to '99'
2026-04-11 16:23:36.754728 [info] PGID defined as '953'
2026-04-11 16:23:36.822806 [warn] UMASK not defined (via -e UMASK), defaulting to '000'
2026-04-11 16:23:36.839551 [info] Permissions already set for '/config'
2026-04-11 16:23:36.857131 [info] Deleting files in /tmp (non recursive)...
2026-04-11 16:23:36.876059 [info] VPN_ENABLED defined as 'yes'
2026-04-11 16:23:36.894501 [info] VPN_CLIENT defined as 'wireguard'
2026-04-11 16:23:36.911492 [info] VPN_PROV defined as 'custom'
2026-04-11 16:23:36.930915 [info] WireGuard config file (conf extension) is located at /config/wireguard/wg0.conf
2026-04-11 16:23:36.952253 [info] VPN_REMOTE_SERVER defined as REDACTED
2026-04-11 16:23:36.970304 [info] VPN_REMOTE_PORT defined as '51820'
2026-04-11 16:23:36.987539 [info] VPN_DEVICE_TYPE defined as 'wg0'
2026-04-11 16:23:37.005295 [info] VPN_REMOTE_PROTOCOL defined as 'udp'
2026-04-11 16:23:37.022285 [info] USERSPACE_WIREGUARD defined as 'no'
2026-04-11 16:23:37.039304 [warn] NAME_SERVERS not defined (via -e NAME_SERVERS), defaulting to name servers defined in readme.md
modprobe: FATAL: Module ip_tables not found in directory /lib/modules/6.19.11-arch1-1
iptables v1.8.11 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
2026-04-11 16:23:37.058345 [crit] iptables default policies not available, exiting script...

[partymola]

Same issue here on kernel 6.19.11. Arch has stopped auto-loading the legacy ip_tables module, so the container's iptables init fails immediately.

Workaround: load the module on the host and persist it:

sudo modprobe ip_tables
echo 'ip_tables' | sudo tee /etc/modules-load.d/iptables.conf

The container will pick it up on the next restart.

Longer term, this is going to keep getting worse - Arch is moving towards nftables-only and the legacy modules could be dropped from the default kernel config eventually. The firewall rules in binhex/scripts (iptable.sh) would need porting to nftables.

I'm happy to do that work and submit a PR to binhex/scripts if @binhex is around to review. I'd add nftables as the primary path with a fallback to legacy iptables for older hosts.