[RESOLVED] [IPTABLES] No chain/target/match by that name.

ouafnico · 2014-10-30 17:11:54

Hello

I'm trying to configure iptables on a little archlinux machine (pcduino).

I tried the little french tutorial to configure the base of iptables rules.

After these rules, I'm stuck (I put them to accept to don't eject me directly, I'll pass them to DROP after) :

# iptables -t filter -P INPUT ACCEPT
# iptables -t filter -P FORWARD ACCEPT
# iptables -t filter -P OUTPUT ACCEPT
# iptables -t filter -A OUTPUT -p udp -m udp --dport 53 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
iptables: No chain/target/match by that name.

I've got the conntrack library installed.

# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain f2b-postfix (0 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain f2b-sshd (0 references)
target prot opt source destination
RETURN all -- anywhere anywhere

I know iptables but the versions I used to configure used "state" in place of "conntrack"

Someone have an idea ?

Thanks

Last edited by ouafnico (2014-10-31 07:54:59)

Spider.007 · 2014-10-30 17:45:17

What does this command say after you get that error?

lsmod|grep tables

ouafnico · 2014-10-30 17:49:14

the command respond nothing.

How is it bad doc ?

branch · 2014-10-30 18:07:54

The rule you posted is correct, and it works on my installation.

Note that you do not need the conntrack library, but your kernel does need the nf_conntrack module. Since this is an ARM board we do not know the kernel configuration. Verify you have the module with:

find /usr/lib/modules -name 'nf_conntrack*'

ps. We like code tags

branch · 2014-10-30 18:13:15

I guess a better check would be:

cd /tmp
cp /proc/config.gz .
gunzip config.gz
grep CONNTRACK config

ouafnico · 2014-10-30 18:26:56

the find gives no results.

Your lasts commands gives :

# grep CONNTRACK config
CONFIG_NF_CONNTRACK=y
# CONFIG_NF_CONNTRACK_MARK is not set
# CONFIG_NF_CONNTRACK_SECMARK is not set
CONFIG_NF_CONNTRACK_PROCFS=y
# CONFIG_NF_CONNTRACK_EVENTS is not set
# CONFIG_NF_CONNTRACK_TIMEOUT is not set
# CONFIG_NF_CONNTRACK_TIMESTAMP is not set
# CONFIG_NF_CONNTRACK_AMANDA is not set
# CONFIG_NF_CONNTRACK_FTP is not set
# CONFIG_NF_CONNTRACK_H323 is not set
# CONFIG_NF_CONNTRACK_IRC is not set
# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set
# CONFIG_NF_CONNTRACK_SNMP is not set
# CONFIG_NF_CONNTRACK_PPTP is not set
# CONFIG_NF_CONNTRACK_SANE is not set
# CONFIG_NF_CONNTRACK_SIP is not set
# CONFIG_NF_CONNTRACK_TFTP is not set
# CONFIG_NETFILTER_XT_MATCH_CONNTRACK is not set
CONFIG_NF_CONNTRACK_IPV4=y
CONFIG_NF_CONNTRACK_PROC_COMPAT=y
# CONFIG_NF_CONNTRACK_IPV6 is not set

Leonid.I · 2014-10-30 23:16:15

ouafnico wrote:

the command respond nothing.
How is it bad doc ?

So, packet filtering lives in the kernel, but the modules are not loaded. This means that you just don't have a firewall.If you are using stock -ARCH kernel, did you reboot after an update?

fukawi2 · 2014-10-31 04:54:22

@ouafnico Please use code tags.

branch wrote:

I guess a better check would be:
cd /tmp
cp /proc/config.gz .
gunzip config.gz
grep CONNTRACK config

Alternatively:

zgrep CONNTRACK /proc/config.gz

ouafnico · 2014-10-31 07:16:15

Yes I have reboot.

How can I load them ?

branch · 2014-10-31 07:50:37

You do not have modules, the "=y" (as opposed to "=m") in the kernel config lines means your firewall code is compiled into the kernel. However, I think your kernel does not have everything you need. I think you need CONFIG_NETFILTER_XT_MATCH_CONNTRACK.

Is this the stock kernel from archlinuxarm? If not, try the stock kernel. If so, fixing this involves recompiling your kernel with the added options.

This page from the Gentoo wiki shows the minimal kernel config options to run a stateful firewall http://wiki.gentoo.org/wiki/Iptables#Kernel

ouafnico · 2014-10-31 07:54:45

oh It's a kernel for pcduino.
I will ask directly the team concerned to add the good modules.

Thanks for your help,

netawater · 2015-05-25 03:24:59

make sure there is xt_nat.ko in your system, which is build by turn on CONFIG_IP_NF_NAT and CONFIG_NETFILTER_XT_NATin kernel configuration.

fukawi2 · 2015-05-25 05:46:45

@netawater NAT is not (directly) related to connection tracking. Also, please leave the dead to rest in peace.

Closing.

Arch Linux

#1 2014-10-30 17:11:54

[RESOLVED] [IPTABLES] No chain/target/match by that name.

#2 2014-10-30 17:45:17

Re: [RESOLVED] [IPTABLES] No chain/target/match by that name.

#3 2014-10-30 17:49:14

Re: [RESOLVED] [IPTABLES] No chain/target/match by that name.

#4 2014-10-30 18:07:54

Re: [RESOLVED] [IPTABLES] No chain/target/match by that name.

#5 2014-10-30 18:13:15

Re: [RESOLVED] [IPTABLES] No chain/target/match by that name.

#6 2014-10-30 18:26:56

Re: [RESOLVED] [IPTABLES] No chain/target/match by that name.

#7 2014-10-30 23:16:15

Re: [RESOLVED] [IPTABLES] No chain/target/match by that name.

#8 2014-10-31 04:54:22

Re: [RESOLVED] [IPTABLES] No chain/target/match by that name.

#9 2014-10-31 07:16:15

Re: [RESOLVED] [IPTABLES] No chain/target/match by that name.

#10 2014-10-31 07:50:37

Re: [RESOLVED] [IPTABLES] No chain/target/match by that name.

#11 2014-10-31 07:54:45

Re: [RESOLVED] [IPTABLES] No chain/target/match by that name.

#12 2015-05-25 03:24:59

Re: [RESOLVED] [IPTABLES] No chain/target/match by that name.

#13 2015-05-25 05:46:45

Re: [RESOLVED] [IPTABLES] No chain/target/match by that name.

Board footer