OTBR Docker Container - failed to start firewall service

[tonivss]

When setting up the OTBR on a nvidia Jetson with ubuntu 22.04 running i get the error "Failed to start firewall service" although i did sudo modprobe ip6tables_filter before starting the container.
I followed the instructions from here Physical RCP.
I have two instances running on Pi 5and Pi 3 without any issues...

RADIO_URL: spinel+hdlc+uart:///dev/ttyACM0
TREL_URL: 
TUN_INTERFACE_NAME: wpan0
BACKBONE_INTERFACE: eth0
NAT64_PREFIX: 64:ff9b::/96
DEBUG_LEVEL: 7
+++ dirname /app/script/server
++ cd /app/script/..
++ HAVE_SYSTEMCTL=0
++ have systemctl
++ command -v systemctl
++ HAVE_SERVICE=0
++ have service
++ command -v service
++ HAVE_SERVICE=1
++ [[ ! -n x ]]
++ echo 'Current platform is ubuntu'
Current platform is ubuntu
++ with BORDER_ROUTING
++ local value
+++ printenv BORDER_ROUTING
++ value=1
++ [[ -z 1 ]]
++ [[ 1 == 1 ]]
++ with DHCPV6_PD
++ local value
+++ printenv DHCPV6_PD
++ value=
++ [[ -z '' ]]
++ [[ -f examples/platforms/ubuntu/default ]]
++ [[ '' == 1 ]]
++ with BORDER_ROUTING
++ local value
+++ printenv BORDER_ROUTING
++ value=1
++ [[ -z 1 ]]
++ [[ 1 == 1 ]]
++ with NETWORK_MANAGER
++ local value
+++ printenv NETWORK_MANAGER
++ value=
++ [[ -z '' ]]
++ [[ -f examples/platforms/ubuntu/default ]]
++ [[ '' == 1 ]]
++ STAGE_DIR=/app/stage
++ BUILD_DIR=/app/build
++ [[ -d /app/stage ]]
++ mkdir -v -p /app/stage
mkdir: created directory '/app/stage'
++ [[ -d /app/build ]]
++ mkdir -v -p /app/build
mkdir: created directory '/app/build'
++ export PATH=/app/stage/usr/bin:/app/stage/usr/sbin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
++ PATH=/app/stage/usr/bin:/app/stage/usr/sbin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+++ basename /app/script/server
++ TASKNAME=server
++ BEFORE_HOOK=examples/platforms/ubuntu/before_server
++ AFTER_HOOK=examples/platforms/ubuntu/after_server
++ [[ ! -f examples/platforms/ubuntu/before_server ]]
++ BEFORE_HOOK=/dev/null
++ [[ ! -f examples/platforms/ubuntu/after_server ]]
++ AFTER_HOOK=/dev/null
+ . script/_nat64
++ NAT64_SERVICE=openthread
++ TAYGA_DEFAULT=/etc/default/tayga
++ TAYGA_CONF=/etc/tayga.conf
++ TAYGA_IPV4_ADDR=192.168.255.1
++ TAYGA_IPV6_ADDR=fdaa:bb:1::1
++ TAYGA_TUN_V6_ADDR=fdaa:bb:1::2
++ NAT64_PREFIX=64:ff9b::/96
++ DYNAMIC_POOL=192.168.255.0/24
++ NAT44_SERVICE=/etc/init.d/otbr-nat44
++ WLAN_IFNAMES=eth0
++ THREAD_IF=wpan0
+ . script/_dns64
++ BIND_CONF_OPTIONS=/etc/bind/named.conf.options
++ NAT64_PREFIX=64:ff9b::/96
++ DNS64_NAMESERVER_ADDR=127.0.0.1
+++ echo 64:ff9b::/96
+++ tr '"/"' '"/"'
++ DNS64_CONF='dns64 64:ff9b::/96 { clients { thread; }; recursive-only yes; };'
++ without NAT64
++ with NAT64
++ local value
+++ printenv NAT64
++ value=1
++ [[ -z 1 ]]
++ [[ 1 == 1 ]]
++ without DNS64
++ with DNS64
++ local value
+++ printenv DNS64
++ value=0
++ [[ -z 0 ]]
++ [[ 0 == 1 ]]
++ '[' ubuntu = raspbian ']'
++ '[' ubuntu = beagleboneblack ']'
++ '[' ubuntu = ubuntu ']'
++ RESOLV_CONF_HEAD=/etc/resolvconf/resolv.conf.d/head
+ . script/_firewall
++ FIREWALL_SERVICE=/etc/init.d/otbr-firewall
++ sudo modprobe ip6table_filter
sudo: modprobe: command not found
++ true
++ FIREWALL=1
+ OTBR_MDNS=mDNSResponder
+ OT_BACKBONE_CI=0
+ REFERENCE_DEVICE=0
+ main
+ [[ '' == \s\h\u\t\d\o\w\n ]]
+ startup
+ . /dev/null
+ sudo sysctl --system
* Applying /etc/sysctl.d/10-console-messages.conf ...
kernel.printk = 4 4 1 7
* Applying /etc/sysctl.d/10-ipv6-privacy.conf ...
net.ipv6.conf.all.use_tempaddr = 2
net.ipv6.conf.default.use_tempaddr = 2
* Applying /etc/sysctl.d/10-kernel-hardening.conf ...
kernel.kptr_restrict = 1
* Applying /etc/sysctl.d/10-link-restrictions.conf ...
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
* Applying /etc/sysctl.d/10-magic-sysrq.conf ...
kernel.sysrq = 176
* Applying /etc/sysctl.d/10-network-security.conf ...
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.tcp_syncookies = 1
* Applying /etc/sysctl.d/10-ptrace.conf ...
kernel.yama.ptrace_scope = 1
* Applying /etc/sysctl.d/10-zeropage.conf ...
vm.mmap_min_addr = 32768
* Applying /etc/sysctl.d/60-otbr-accept-ra.conf ...
net.ipv6.conf.eth0.accept_ra = 2
net.ipv6.conf.eth0.accept_ra_rt_info_max_plen = 64
* Applying /etc/sysctl.d/60-otbr-ip-forward.conf ...
net.ipv6.conf.all.forwarding = 1
net.ipv4.ip_forward = 1
* Applying /etc/sysctl.conf ...
+ nat64_start
+ with NAT64
+ local value
++ printenv NAT64
+ value=1
+ [[ -z 1 ]]
+ [[ 1 == 1 ]]
+ '[' openthread = tayga ']'
+ nat44_start
+ with DOCKER
+ local value
++ printenv DOCKER
+ value=1
+ [[ -z 1 ]]
+ [[ 1 == 1 ]]
+ service otbr-nat44 start
+ dns64_start
+ with NAT64
+ local value
++ printenv NAT64
+ value=1
+ [[ -z 1 ]]
+ [[ 1 == 1 ]]
+ with DNS64
+ local value
++ printenv DNS64
+ value=0
+ [[ -z 0 ]]
+ [[ 0 == 1 ]]
+ return 0
+ firewall_start
+ with FIREWALL
+ local value
++ printenv FIREWALL
+ value=1
+ [[ -z 1 ]]
+ [[ 1 == 1 ]]
+ with DOCKER
+ local value
++ printenv DOCKER
+ value=1
+ [[ -z 1 ]]
+ [[ 1 == 1 ]]
+ service otbr-firewall start
+ case "$1" in
+ firewall_start
+ firewall_stop
+ ip6tables -C FORWARD -o wpan0 -j OTBR_FORWARD_INGRESS
ip6tables v1.6.1: Couldn't load target `OTBR_FORWARD_INGRESS':No such file or directory

Try `ip6tables -h' or 'ip6tables --help' for more information.
+ ip6tables -L OTBR_FORWARD_INGRESS
ip6tables: No chain/target/match by that name.
+ ipset_destroy_if_exist otbr-ingress-deny-src
+ ipset list otbr-ingress-deny-src
ipset v6.34: Kernel error received: Invalid argument
+ ipset_destroy_if_exist otbr-ingress-deny-src-swap
+ ipset list otbr-ingress-deny-src-swap
ipset v6.34: Kernel error received: Invalid argument
+ ipset_destroy_if_exist otbr-ingress-allow-dst
+ ipset list otbr-ingress-allow-dst
ipset v6.34: Kernel error received: Invalid argument
+ ipset_destroy_if_exist otbr-ingress-allow-dst-swap
+ ipset list otbr-ingress-allow-dst-swap
ipset v6.34: Kernel error received: Invalid argument
+ ipset create -exist otbr-ingress-deny-src hash:net family inet6
ipset v6.34: Kernel error received: Invalid argument
+ die 'Failed to start firewall service'
+ echo ' *** ERROR:  Failed to start firewall service'
 *** ERROR:  Failed to start firewall service
+ exit 1```

[superwhd]

It seems this kernel doesn't support the ipset features required by firewall.

I'd suggest to set FIREWALL=0 argument when building the docker container.

Reference: https://github.com/openthread/ot-br-posix/blob/e2f3c1fe8f12bcd5f51cfc220261cd19a73bd81e/etc/docker/Dockerfile#L45