# Why does iptables fail with 'xt_owner module missing' in a sandbox? (/docs/faq/iptables-xt-owner)

<!-- agent-signals: reading_time_min: 1 · est_tokens: 190 · updated: 2026-07-30 -->
Related: [How do I increase my concurrency limit?](/docs/faq/increase-concurrency.md), [Do paused sandboxes count toward the concurrency limit?](/docs/faq/paused-sandboxes-concurrency.md), [Is there a limit on how many templates I can create?](/docs/faq/template-limit.md), [Can I make a template public so other projects can use it?](/docs/faq/public-templates.md), [Can I run sandboxes in the EU?](/docs/faq/eu-region.md), [Why does pip install fail when building a template?](/docs/faq/pip-install-error.md)

The `xt_owner` kernel module is not currently available in E2B's sandbox kernel. As a result, iptables rules that depend on it (most commonly `NAT REDIRECT` with `--uid-owner` or `--gid-owner`, used in transparent proxy setups) will fail with:

```
Warning: Extension owner revision 0 not supported, missing kernel module?
```

The command exits with code 4, which aborts any script running under `set -e`.

## Workaround: use nftables [#workaround-use-nftables]

[nftables](https://wiki.nftables.org/wiki-nftables/index.php/Main_Page) is the modern replacement for iptables and does not depend on the `xt_owner` module for owner-based matching. If you're setting up a transparent proxy or any rule that matches on user/group ownership, use nftables instead.