Iptables geo filtering

I just compiled a LEDE build for my wrt1900ac. i selected most iptables addons that i think should support geo filtering. However when i try to run the iptables command with geo filtering it gives an error:

iptables -A INPUT -m geoip ! --src-cc CN,CO,SG,YC,OD,ES -i eth1.2 -m conntrack --ctstate NEW -j DROP
Error loading shared library libnetfilter_conntrack.so.3: No such file or directory (needed by /usr/sbin/iptables)
Error loading shared library libnfnetlink.so.0: No such file or directory (needed by /usr/sbin/iptables)

i have the following iptables packages installed on the router:

what else could i be missing? Thanks

You seem to be missing at least libnetfilter-conntrack and libnfnetlink.

# opkg search /usr/lib/libnetfilter_conntrack.so.3
libnetfilter-conntrack - 1.0.6-1

# opkg search /usr/lib/libnfnetlink.so.0
libnfnetlink - 1.0.1-1

Thanks. While ive sorted out the setup and all. But looks like the block rule is working/or getting triggered.

i can see the geoip block rule in my firewall. However when i test by coming into my home from the outside (using a vpn to seem like im coming from one of the blocked coutries). Im still able to hit my internal webserver, etc…And i dont see the packaets being dropped on my firewall.
Just wondering where can i get more help on this, From the looks of it, my setup it correct.

Does anyone know if the package "xtables-addons" exists in openwrt/LEDE. I cannot find it anywhere in the build environment.


Appears like it should be, there was a FS marked as fixed, it is there under feeds/, but...

Thanks. but that is a useless post.

But for some reason it doesnt show in the feed:

lede$ scripts/feeds search xtables
Search results in feed 'packages':
iptables-mod-account     	ACCOUNT iptables extension
iptables-mod-chaos       	CHAOS iptables extension
iptables-mod-condition   	Condition iptables extension
iptables-mod-delude      	DELUDE iptables extension
iptables-mod-dhcpmac     	DHCPMAC iptables extension
iptables-mod-dnetmap     	DNETMAP iptables extension
iptables-mod-fuzzy       	fuzzy iptables extension
iptables-mod-geoip       	geoip iptables extension
iptables-mod-iface       	iface iptables extension
iptables-mod-ipmark      	IPMARK iptables extension
iptables-mod-ipp2p       	IPP2P iptables extension
iptables-mod-ipv4options 	ipv4options iptables extension
iptables-mod-length2     	length2 iptables extension
iptables-mod-logmark     	LOGMARK iptables extension
iptables-mod-lscan       	lscan iptables extension
iptables-mod-lua         	Lua PacketScript iptables extension
iptables-mod-psd         	psd iptables extension
iptables-mod-quota2      	quota2 iptables extension
iptables-mod-sysrq       	SYSRQ iptables extension
iptables-mod-tarpit      	TARPIT iptables extension
iptaccount               	iptables-mod-account control utility
iptgeoip                 	iptables-mod-geoip support scripts for MaxMind GeoIP databases
kmod-ipt-compat-xtables  	API compatibilty layer netfilter module
lede_source$ find feeds -name Makefile -exec fgrep -H  "xtables-addons" {} \;
feeds/packages/net/xtables-addons/Makefile:define Package/xtables-addons

ok. while i can also find it in the same path using the find command. i cannot find the 'xtables-addons' as a package that i can select to be inclluded in my build.Sorry im not an expert at development. Just enough knowledge to compile a custom image using the LEDE build environment.
see attached picture when i search in the make menuonfig interface. I only find those two entries.

Even with enabling


I don't find it either. Might be a bug in the package or the build system as it should be under Network > Firewall

define Package/xtables-addons
  TITLE:=Extensions not distributed in the main Xtables

Thanks for the help. Would you know where/whom i could report this to in case this is a bug ?

Does anyone know where i can report this as there seems to be a missing module that doesnt show up in make menuconfig.

If you want I can make a pr to include the missing module

Thanks. but i did open an issue on github at: https://github.com/openwrt/packages/issues/6234