Target rules does not work on kernel 2.6.17.x.
Hi.
Having trouble with iptables when upgrading from kernel 2.6.13 to 2.6.17.x . My old firewall rules are not functioning anymore.
Target rules that are using -j DNAT such as this one:
$IPTABLES -A PREROUTING -t nat -i $EXT -p tcp --dport 3389 -j DNAT --to 192.168.x.x:3389
and j- ACCEPT
$IPTABLES -A INPUT -p tcp -i $EXT -d 0/0 --dport 3724 -j ACCEPT
Does not work.
For iptables 1.3.4 it does not work (returns an errorcode) and for 1.3.5_iptables-1.3.5-20060702 it returns
iptables: No chain/target/match by that name
I have all iptables dependent modules in the kernel set as loadable modules. So I do this in the beginning of the firewall script:
modprobe ip_tables
modprobe ip_conntrack_irc
modprobe ip_conntrack
modprobe ip_nat_irc
modprobe iptable_filter
modprobe iptable_nat
modprobe iptable_mangle
modprobe ipt_conntrack
modprobe ipt_MASQUERADE
modprobe ipt_multiport
modprobe ipt_state
modprobe ipt_REDIRECT
modprobe ipt_REJECT
modprobe ipt_LOG
Anyone have any ideas on how to proceed on this ?
I really need 2.6.17.x in order to activate new wireless functions that has been added into the 2.6.17.x kernel.
Cheers
/P
Quoted 2 lines
My old firewall rules are not functioning anymore.
Try specifying -t nat before ALL options. ebtables for instance required this for long, i.e.
iptables -t nat -A PREROUTING...
Quoted 32 lines
Target rules that are using -j DNAT such as this one:
$IPTABLES -A PREROUTING -t nat -i $EXT -p tcp --dport 3389 -j DNAT --to 192.168.x.x:3389and j- ACCEPT
$IPTABLES -A INPUT -p tcp -i $EXT -d 0/0 --dport 3724 -j ACCEPTDoes not work.
For iptables 1.3.4 it does not work (returns an errorcode) and for 1.3.5_iptables-1.3.5-20060702 it returnsiptables: No chain/target/match by that name
I have all iptables dependent modules in the kernel set as loadable modules. So I do this in the beginning of the firewall script:
modprobe
ip_tables
modprobeip_conntrack_irc
modprobeip_conntrack
modprobeip_nat_irc
modprobeiptable_filter
modprobeiptable_nat
modprobeiptable_mangle
modprobeipt_conntrack
modprobeipt_MASQUERADE
modprobeipt_multiport
modprobeipt_state
modprobeipt_REDIRECT
modprobeipt_REJECT
modprobeipt_LOG
Quoted 13 lines
Anyone have any ideas on how to proceed on this ?
I really need 2.6.17.x in order to activate new wireless functions that has been added into the 2.6.17.x kernel.Cheers
/P
Jan Engelhardt
Hi.
Found the problem.
Apparently I needed the itp_tcp module.
Earlier kernels must have included it in some other module.
/Pär
Jan Engelhardt skrev:
Quoted 57 lines
Quoted 2 lines
My old firewall rules are not functioning anymore.
Try specifying -t nat before ALL options. ebtables for instance required this for long, i.e.
iptables -t nat -A PREROUTING...
Quoted 31 lines
Target rules that are using -j DNAT such as this one:
$IPTABLES -A PREROUTING -t nat -i $EXT -p tcp --dport 3389 -j DNAT --to 192.168.x.x:3389and j- ACCEPT
$IPTABLES -A INPUT -p tcp -i $EXT -d 0/0 --dport 3724 -j ACCEPTDoes not work.
For iptables 1.3.4 it does not work (returns an errorcode) and for 1.3.5_iptables-1.3.5-20060702 it returnsiptables: No chain/target/match by that name
I have all iptables dependent modules in the kernel set as loadable modules. So I do this in the beginning of the firewall script:
modprobe
ip_tables
modprobeip_conntrack_irc
modprobeip_conntrack
modprobeip_nat_irc
modprobeiptable_filter
modprobeiptable_nat
modprobeiptable_mangle
modprobeipt_conntrack
modprobeipt_MASQUERADE
modprobeipt_multiport
modprobeipt_state
modprobeipt_REDIRECT
modprobeipt_REJECT
modprobeipt_LOGQuoted 14 lines
Anyone have any ideas on how to proceed on this ?
I really need 2.6.17.x in order to activate new wireless functions that has been added into the 2.6.17.x kernel.Cheers
/P
Jan Engelhardt