Istio DNS Proxying cause iptable error

1

Hi,

If I install Istio with the basic configuration, like istioctl install -y, sidecar can be injected and started correctly. But if I install Istio with DNS proxy, like this document, the istio-init container will fail with an iptable error.

2021-11-26T05:33:12.055213Z	info	Running command: iptables-restore --noflush /tmp/iptables-rules-1637904792054999130.txt2599449728
2021-11-26T05:33:12.057241Z	error	Command error output: xtables parameter problem: unknown option "--zone"
Error occurred at line: 31
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
2021-11-26T05:33:12.057288Z	error	Failed to execute: iptables-restore --noflush /tmp/iptables-rules-1637904792054999130.txt2599449728, exit status 2

My system is:

  • Windows 11 x64

  • Docker Desktop 4.2.0 (70708)

  • istioctl version

    client version: 1.12.0
control plane version: 1.12.0
data plane version: 1.12.0 (1 proxies)

Update

I have Linux machine with minikube. The same Istio + DNS proxy on it works. The only difference between the two Istio installations is the number of proxies. On my Linux box, istioctl version says:

client version: 1.12.0
control plane version: 1.12.0
data plane version: 1.12.0 (2 proxies)

Note, it has 2 proxies while on my Windows machine, I only got 1 proxy.

2

I tried this on a minikube environment on my Windows and got the same iptable error. I think this is unique on Windows environment. My guess is that the generated iptable rules file contains some invalid entries.

info	Running command: iptables-restore --noflush /tmp/iptables-rules-1637904792054999130.txt2599449728
3

Hi,

I am facing similar issue on windows with KiND for istio version: 1.14.5 and K8s version: 1.24.6.

Error:
2022-10-12T09:46:33.190683Z info Running command: iptables-restore --noflush /tmp/iptables-rules-1665567993190338700.txt1541162411
2022-10-12T09:46:33.194034Z error Command error output: xtables other problem: line 2 failed
2022-10-12T09:46:33.194078Z error Failed to execute: iptables-restore --noflush /tmp/iptables-rules-1665567993190338700.txt1541162411, exit status 1

Is there a way to fix this or workaround?