# Iptable kernel modules in 8.5 **URL:** \ **Category:** Rocky Linux Help & Support\ **Created:** [February 4, 2022, 10:00pm UTC](https://forums.rockylinux.org/t/iptable-kernel-modules-in-8-5/5297 "2022-02-04T22:00:12Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![grumpymatt](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/grumpymatt/32/1680_2.png) [@grumpymatt](https://forums.rockylinux.org/u/grumpymatt)\ **Post date:** [February 4, 2022, 10:00pm UTC](https://forums.rockylinux.org/t/iptable-kernel-modules-in-8-5/5297/1 "2022-02-04T22:00:12Z")
We recently upgraded from 8.4 to 8.5, and we noticed the default kernel modules for iptables changes. The modules ip\_tables, iptable\_nat, and iptable\_mangle were no longer loaded by default. This seems to be a difference from 8.4 where they were loaded. We do have firewalld installed. This wasn’t really an issue, but it caused the AWS CNI driver for EKS to fail to run if these modules were not loaded. My question is why these modules are no longer loaded default? Is there any reason we should not load them in 8.5? ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [February 4, 2022, 10:28pm UTC](https://forums.rockylinux.org/t/iptable-kernel-modules-in-8-5/5297/2 "2022-02-04T22:28:54Z")
It might relate to the: [Chapter 4. New features Red Hat Enterprise Linux 8 | Red Hat Customer Portal](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/new-features#enhancement_networking) - firewalld was rebased to 0.9.3 - NetworkManager supports nftables as backend Moreover, EL8 does not have iptables-legacy [iptables: The two variants and their relationship with nftables | Red Hat Developer](https://developers.redhat.com/blog/2020/08/18/iptables-the-two-variants-and-their-relationship-with-nftables#the_iptables_rules_appear_in_the_nftables_rule_listing) Decreasing the use of deprecated features (iptables) seems logical, although breaking existing setups without easy to find documentation does not sound typical RHEL. ---
**Author:** ![grumpymatt](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/grumpymatt/32/1680_2.png) [@grumpymatt](https://forums.rockylinux.org/u/grumpymatt)\ **Post date:** [February 7, 2022, 10:52pm UTC](https://forums.rockylinux.org/t/iptable-kernel-modules-in-8-5/5297/3 "2022-02-07T22:52:25Z")
Thanks for the link explaining iptables-legacy and iptables-nft. I believe the source of the problem is the difference in what is installed on the host and what is installed in the AWS CNI driver container image. The image has iptables-legacy and the hosts now have iptables-nft. I’m still working on the bast way to resolve. ---
**Author:** ![brian](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/brian/32/5777_2.png) [@brian](https://forums.rockylinux.org/u/brian)\ **Post date:** [August 25, 2023, 3:55am UTC](https://forums.rockylinux.org/t/iptable-kernel-modules-in-8-5/5297/4 "2023-08-25T03:55:41Z")