Amazon Linux 2023

Failed to start iptables.service: Unit iptables.service not found.

Failed to start iptables.service: Unit iptables.service not found.

What it means

Amazon Linux 2023 drops the iptables-services unit; nftables is the default firewall backend.

Why it happens

On Amazon Linux 2, the `iptables-services` package shipped an `iptables.service` that saved and restored rules across reboots. AL2023 standardizes on nftables and does not install that service by default, so user-data / cloud-init / Ansible that enables or starts `iptables.service` fails on AL2023.

How to fix it

  1. Migrate rules to nftables: convert existing rules with `iptables-translate`, save them under `/etc/nftables/`, and enable `sudo systemctl enable --now nftables`.
  2. To keep iptables syntax, use the `iptables-nft` compatibility layer (rules are stored by nftables); manage persistence with the `nftables` service, not `iptables.service`.
  3. Remove `iptables-services` / `iptables.service` references from user-data, Ansible, and Packer builds.
  4. Verify the active ruleset with `sudo nft list ruleset`.

Related deadline: Amazon Linux 2 EOL — 2026-06-30.

Find every instance in your project

The free EOLkits scanner runs in your browser (nothing uploaded) and flags this and related breakages across your IaC and dependency files.

Primary source: https://docs.aws.amazon.com/linux/al2023/ug/compare-with-al2.html

Get the full migration audit — $299, hash-anchored PDF →