Amazon Linux 2023

Failed to start iptables.service: Unit iptables.service not found.

Failed to start iptables.service: Unit iptables.service not found.

What it means

Amazon Linux 2023 drops the iptables-services unit; nftables is the default firewall backend.

Why it happens

On Amazon Linux 2, the `iptables-services` package shipped an `iptables.service` that saved and restored rules across reboots. AL2023 standardizes on nftables and does not install that service by default, so user-data / cloud-init / Ansible that enables or starts `iptables.service` fails on AL2023.

How to fix it

  1. Migrate rules to nftables: convert existing rules with `iptables-translate`, save them under `/etc/nftables/`, and enable `sudo systemctl enable --now nftables`.
  2. To keep iptables syntax, use the `iptables-nft` compatibility layer (rules are stored by nftables); manage persistence with the `nftables` service, not `iptables.service`.
  3. Remove `iptables-services` / `iptables.service` references from user-data, Ansible, and Packer builds.
  4. Verify the active ruleset with `sudo nft list ruleset`.

Related deadline: Amazon Linux 2 EOL — 2026-06-30.

Check configured patterns in your project

The free EOLkits scanner processes files in your browser and flags selected related patterns in supported IaC and dependency files. File names and contents are not uploaded; bounded aggregate file and finding counts may be sent. It is not a complete source or AWS-account scan.

Prefer a 10-second check? Paste your config into the free AWS EOL checker. Pasted input is not uploaded; bounded first-party usage events may be sent.

Primary source: https://docs.aws.amazon.com/linux/al2023/ug/compare-with-al2.html

Inspect the $299 report sample and availability →