Is p-o-m still the correct thing to use?

The latest version of POM seems to be from 2004, and I saw some references in the mailing list archive seeming to indicate that is' being deprecated, but is there anything to replace it?

I'd really like to patch in TARPITs, but the latest POM does not work with the latest iptable src ("doesn't look like a iptables source code directory to me.")

Quoted 1 line

The latest version of POM seems to be from 2004, and I saw some references in the mailing list archive seeming to indicate that is' being deprecated, but is there anything to replace it?

For POM-ng, if you look in the snapshot directory of the FTP server, you'll find daily versions up to yesterday. However, I recently tried to use on of those to install the condition patch, and it failed for reasons that I wasn't able to figure out in 30 mins. or so of research.

POM has now been superseded by xtables-addons
(http://jengelh.medozas.de/projects/xtables/). Unfortunately the netfilter site hasn't been updated yet to reflect this. Discussion threads on that in this forum within the last week:

POM Xtables???
patch-0-matic problems..?

At first I was annoyed at yet another big change in netfilter patching, but xtables-addons is better because it doesn't require you to patch either your kernel or iptables.

Quoted 1 line

I'd really like to patch in TARPITs, but the latest POM does not work with the latest iptable src ("doesn't look like a iptables source code directory to me.")

You have to run ./configure in your iptables source dir first. Not sure if that used to be the case-- I think it wasn't.

That gets to wny I always used to hate using POM. It was unique and volatile-- about once a year someone would change something and my script would break and I'd have to go back and figure it all out again. Good riddance, I say.

Good luck,
Andrew.

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Thanks a lot for the help, Andrew. The iptables source I have doesn't have a configure script...oh, but it does have an autogen script. I guess I was probably supposed to use that first. But it's a moot point, apparently, because of xtables, so I will be switching to that.

Quoted 5 lines · Brian Mearns

Thanks a lot for the help, Andrew. The iptables source I have doesn't have a configure script...oh, but it does have an autogen script. I guess I was probably supposed to use that first. But it's a moot point, apparently, because of xtables, so I will be switching to that.

Released tarballs should have configure; for autogen, you usually need (even more) developer tools than you do without, like autoconf, automake, and the other autowhatevers.

No moot point; iptables still is, as of today, the name of the userspace package and control program.

Thanks for the help Jan and Andrew. I've got xtables (combined) and it built and installed fine. When I run iptables --version, it matches what's given in the versions file in the source distribution. My problem is that the TARPIT target doesn't seem to be recognized. When I try to add a rule with the TARPIT target, it says "iptables: No chain/target/match by that name". I've tried using rules that work otherwise, for instance, changing from DROP to TARPIT, and it still doesn't work, so it's not the rest of the rule that is the problem.

I found libxt_TARPIT.so in /usr/local/libexec/xtables/. Is it in the wrong spot or something?

Also, my service runs from
/sbin/iptables, but this is soft linked to /usr/local/sbin/iptables: could this be part of the problem?

Quoted 2 lines

I found libxt_TARPIT.so in /usr/local/libexec/xtables/. Is it in the wrong spot or something?

If you used -combined, there is no problem, as the same prefix (see below) is passed to both the bundle's components ./configure. You may need to run depmod -a after make install.

I added a patch that will always do this now.

Has you the kernel module for TARPIT (look for it into kernel modules, usually into /lib/modules/$(uname -r)/kernel/net/netfilter or .../net/ipv4/netfilter).

Or perhaps the problem was that you have the "ipt" version and the "xt" version and there is a problem with them at the same time.

Regards

Quoted 43 lines · Brian Mearns

Thanks for the help Jan and Andrew. I've got xtables (combined) and it built and installed fine. When I run iptables --version, it matches what's given in the versions file in the source distribution. My problem is that the TARPIT target doesn't seem to be recognized. When I try to add a rule with the TARPIT target, it says "iptables: No chain/target/match by that name". I've tried using rules that work otherwise, for instance, changing from DROP to TARPIT, and it still doesn't work, so it's not the rest of the rule that is the problem.

I found libxt_TARPIT.so in /usr/local/libexec/xtables/. Is it in the wrong spot or something? Also, my service runs from /sbin/iptables, but this is soft linked to /usr/local/sbin/iptables: could this be part of the problem? I did this so my package manager doesn't overwrite it any point, but maybe it was a bad idea?

Any help would be great.

Thanks,
-Brian

Quoted 9 lines · Jan Engelhardt

Quoted 5 lines · Brian Mearns

Thanks a lot for the help, Andrew. The iptables source I have doesn't have a configure script...oh, but it does have an autogen script. I guess I was probably supposed to use that first. But it's a moot point, apparently, because of xtables, so I will be switching to that.

Quoted 6 lines

Released tarballs should have configure; for autogen, you usually need (even more) developer tools than you do without, like autoconf, automake, and the other autowhatevers.

No moot point; iptables still is, as of today, the name of the userspace package and control program.

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html