Iptables fails on -m state --state!

Hi there,

even if the corresponding module is built into the kernel and loaded, iptables fails (No chain/target/match with that name, or something like that).

What can I do?

Thanks

Marco Nicoloso

Please show us the output of :

cat /proc/net/ip_tables_matches | grep state

And show us the rule you did input.

Best regards,
Samuel

cat /proc/net/ip_tables_matches | grep state doesn't return anything but the contents of ip_tables_matches are:

tcp
udp
icmp

while the rules are (I post my script entirely):
#!/bin/bash
/sbin/iptables -v -P INPUT DROP
/sbin/iptables -v -P OUTPUT DROP
/sbin/iptables -v -P FORWARD DROP
/sbin/iptables -v -N bad_tcp_packets
/sbin/iptables -v -N allowed
/sbin/iptables -v -N tcp_packets
/sbin/iptables -v -N udp_packets
/sbin/iptables -v -N icmp_packets
/sbin/iptables -v -A bad_tcp_packets -p TCP --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset #Fails
/sbin/iptables -v -A bad_tcp_packets -p TCP ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:" #FAILS
/sbin/iptables -v -A bad_tcp_packets -p TCP ! --syn -m state --state NEW -j DROP #FAILS
/sbin/iptables -v -A allowed -p TCP --syn -j ACCEPT
/sbin/iptables -v -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT #FAILS
/sbin/iptables -v -A allowed -p TCP -j DROP
/sbin/iptables -v -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed /sbin/iptables -v -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed /sbin/iptables -v -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed /sbin/iptables -v -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed /sbin/iptables -v -A udp_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT /sbin/iptables -v -A udp_packets -p UDP -s 0/0 --source-port 2074 -j ACCEPT /sbin/iptables -v -A udp_packets -p UDP -s 0/0 --source-port 4000 -j ACCEPT /sbin/iptables -v -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT /sbin/iptables -v -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT /sbin/iptables -v -A INPUT -p ALL -i eth0 -s 192.168.0.240/28 -j ACCEPT /sbin/iptables -v -A INPUT -p ALL -i lo -j ACCEPT /sbin/iptables -v -A INPUT -p UDP -i eth0 --dport 67 --sport 68 -j ACCEPT
/sbin/iptables -v -A INPUT -p ALL -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT #FAILS
/sbin/iptables -v -A INPUT -p TCP -i eth1 -j tcp_packets /sbin/iptables -v -A INPUT -p UDP -i eth1 -j udp_packets /sbin/iptables -v -A INPUT -p ICMP -i eth1 -j icmp_packets
/sbin/iptables -v -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: " #FAILS
/sbin/iptables -v -A FORWARD -p tcp -j bad_tcp_packets /sbin/iptables -v -A FORWARD -i eth0 -j ACCEPT
/sbin/iptables -v -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT #FAILS
/sbin/iptables -v -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: " #FAILS
/sbin/iptables -v -A OUTPUT -p ALL -s 127.0.0.1 -j ACCEPT /sbin/iptables -v -A OUTPUT -p ALL -s 14.0.217.49 -j ACCEPT /sbin/iptables -v -A OUTPUT -p ALL -o eth1 -j ACCEPT
/sbin/iptables -v -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: " #FAILS

it sounds an awful lot like you compiled your kernel without:

CONFIG_IP_NF_MATCH_STATE=y

and you would obviously also need:

CONFIG_IP_NF_CONNTRACK=y

in there as well...

-j

--
"When will I learn? The answer to life's problems aren't at the bottom
of a bottle, they're on TV!"
--The Simpsons

Of Course I did, as I said in the previous post! But I think I'll try with a different kernel version (maybe the vanilla sources for 2.6.10). Thanks.

Marco Nicoloso