logdrop rule does not work any more

Hi all,

I haven´t found any hint about my problem so I would like to ask about logdrop rule.

I had iptables 1.3.6 from Debian Etch distro and I use logdrop rule like these rules:

ipt="/sbin/iptables"

modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ipt_MASQUERADE
modprobe ipt_state

$ipt -P INPUT ACCEPT
$ipt -P OUTPUT ACCEPT
$ipt -P FORWARD ACCEPT
$ipt -P logdrop ACCEPT

$ipt -F INPUT
$ipt -F OUTPUT
$ipt -F -t nat
$ipt -F -t mangle
$ipt -F logdrop

$ipt -X logdrop
$ipt -N logdrop
$ipt -A logdrop -j LOG --log-prefix "logdrop"
$ipt -A logdrop -j DROP
...
$ipt -t mangle -A POSTROUTING -p tcp --dport 25 -j logdrop ... for example

It worked fain until I had to compile new iptables version 1.4.0 and my problem has appeared every time when I start my firewall script.

The error message is here:

iptables: Bad built-in chain name
iptables v1.4.0: Couldn't load target `logdrop':/usr/local/lib/iptables/libipt_logdrop.so: cannot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
I do not know why during the compilation of new iptables, there is not libipt_logdrop.so module while in version 1.3.6 there had to be in directory, because no errors ever appeared.

In changelog from 1.3.6 to 1.4.0, there is no information about cancelling logdrop support.

So where is the problem ?
What do I do in wrong way ?

Thank you.

Dan

P.S.: I am not subscribed in mailling list, mail me directly please.

Daniel Dvoøák írta:

Policy is not supported on non built-in chains...

See below..

Okay...

Use this:
$ipt -F -t filter
$ipt -F -t raw

not needed...

It is not a good idea to drop packets in other than the filter table... But if you want to do that then declare the logdrop chain in the mangle table !!!

$ipt -t mangle -N logdrop
$ipt -t mangle -A logdrop .....

Swifty