No chain/target/match by that name

DISCUSSION Steve Turnbull 4 participants 8 messages Sep 5, 2004 – Sep 6, 2004

Share & tools

Steve Turnbull

author

2004-09-05 14:31 UTC #0 lore raw

Our web server is configured;
Debian (Woody) (No X installed)
Kernel 2.4.23 - configured with iptables in mind
iptables v1.2.6a

When we start the firewall script, we get this message; 'No chain/target/match by that name'

The firewall works however, but is constantly logging;
'Sep 5 16:00:52 www kernel: Input: IN=eth0 OUT= MAC=00:e0:81:29:01:75:00:07:85:06:c2:e1:08:00 SRC=195.92.195.93 DST=195.92.38.54 LEN=302 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=53 DPT=32833 LEN=282'

Something is ammis here, and we can't ping out from the server with the firewall running, also, we can't use Lynx to browse. Turn the firewall off and all is well for both of these.

Has anybody got any ideas what is wrong? Our firewall rule is below.

Regards
Steve

#!/bin/sh

#
# This is the firewall up script.
#

#
# Lets start by dropping all incoming traffic and allowing all

# outbound traffic
#

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Flush any existing rules...
iptables -F

# Allow any established connections to come on through... iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# This is a web server. We only require access to http ports # 80,21,53 and 443. New ports to allow will be added here... iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT

#ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

#ftp
iptables -A INPUT -p tcp --dport 21 -j ACCEPT

#DNS
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT

# Allow the loopback connection...
iptables -A INPUT -i lo -j ACCEPT

# Log stuff that doesn't match above rules...
iptables -A INPUT -j LOG --log-prefix="Input: "

Signature · 6 lines

Steve Turnbull
Digital Content Developer
YHGfL Foundation

t 01724 275030
e [email protected]

Jason Opperisano

2004-09-05 14:54 UTC #1 lore raw

Quoted 9 lines · Steve Turnbull

Hi
Our web server is configured;
Debian (Woody) (No X installed)
Kernel 2.4.23 - configured with iptables in mind
iptables v1.2.6a
When we start the firewall script, we get this message; 'No chain/target/match by that name'

start your fw script with the following:

bash -x <script>

and it will show you the parsing of every line and you will be able to see which line causes the error.

if i had to take a stab in the dark--i'd guess it's "-m state" rule; which would mean you built your kernel without connection tracking support--which would explain the other behavior as well...

the connection tracking option is "CONFIG_IP_NF_CONNTRACK" in your kernel config. i *highly* recommend including it unless you have a very compelling reason not to.

-j

Signature · 1 line

Jason Opperisano <[email protected]>

Steve Turnbull

author

2004-09-05 15:52 UTC #2 lore raw

Quoted 24 lines · Jason Opperisano

Quoted 9 lines · Steve Turnbull
Hi
Our web server is configured;
Debian (Woody) (No X installed)
Kernel 2.4.23 - configured with iptables in mind
iptables v1.2.6a
When we start the firewall script, we get this message; 'No chain/target/match by that name'
start your fw script with the following:
bash -x <script>
and it will show you the parsing of every line and you will be able to see which line causes the error.
if i had to take a stab in the dark--i'd guess it's "-m state" rule; which would mean you built your kernel without connection tracking support--which would explain the other behavior as well...

Quoted 6 lines

the connection tracking option is "CONFIG_IP_NF_CONNTRACK" in your kernel config. i *highly* recommend including it unless you have a very compelling reason not to.
-j

Thanks for the reply

Our Kernel .config file (iptables extract) shows this (see below), which suggests CONNTRACK is on. Does any of the other setting need compiling in??

Regards
Steve

#
# IP: Netfilter Configuration
#
CONFIG_IP_NF_CONNTRACK=y
CONFIG_IP_NF_FTP=y
# CONFIG_IP_NF_AMANDA is not set
# CONFIG_IP_NF_TFTP is not set
# CONFIG_IP_NF_IRC is not set
# CONFIG_IP_NF_QUEUE is not set
CONFIG_IP_NF_IPTABLES=y
# CONFIG_IP_NF_MATCH_LIMIT is not set
# CONFIG_IP_NF_MATCH_MAC is not set
# CONFIG_IP_NF_MATCH_PKTTYPE is not set
# CONFIG_IP_NF_MATCH_MARK is not set
# CONFIG_IP_NF_MATCH_MULTIPORT is not set
# CONFIG_IP_NF_MATCH_TOS is not set
# CONFIG_IP_NF_MATCH_RECENT is not set
# CONFIG_IP_NF_MATCH_ECN is not set
# CONFIG_IP_NF_MATCH_DSCP is not set
# CONFIG_IP_NF_MATCH_AH_ESP is not set
# CONFIG_IP_NF_MATCH_LENGTH is not set
# CONFIG_IP_NF_MATCH_TTL is not set
# CONFIG_IP_NF_MATCH_TCPMSS is not set
# CONFIG_IP_NF_MATCH_HELPER is not set
CONFIG_IP_NF_MATCH_STATE=y
CONFIG_IP_NF_MATCH_CONNTRACK=y
# CONFIG_IP_NF_MATCH_UNCLEAN is not set
# CONFIG_IP_NF_MATCH_OWNER is not set
CONFIG_IP_NF_FILTER=y
# CONFIG_IP_NF_TARGET_REJECT is not set
# CONFIG_IP_NF_TARGET_MIRROR is not set
# CONFIG_IP_NF_NAT is not set
# CONFIG_IP_NF_MANGLE is not set
CONFIG_IP_NF_TARGET_LOG=y
CONFIG_IP_NF_TARGET_ULOG=y
# CONFIG_IP_NF_TARGET_TCPMSS is not set
# CONFIG_IP_NF_ARPTABLES is not set

Signature · 6 lines

Steve Turnbull
Digital Content Developer
YHGfL Foundation

t 01724 275030
e [email protected]

Steve Turnbull

author

2004-09-05 15:55 UTC #3 lore raw

In reply to Jason Opperisano

Quoted 24 lines · Jason Opperisano

Quoted 9 lines · Steve Turnbull
Hi
Our web server is configured;
Debian (Woody) (No X installed)
Kernel 2.4.23 - configured with iptables in mind
iptables v1.2.6a
When we start the firewall script, we get this message; 'No chain/target/match by that name'
start your fw script with the following:
bash -x <script>
and it will show you the parsing of every line and you will be able to see which line causes the error.
if i had to take a stab in the dark--i'd guess it's "-m state" rule; which would mean you built your kernel without connection tracking support--which would explain the other behavior as well...

Quoted 6 lines

the connection tracking option is "CONFIG_IP_NF_CONNTRACK" in your kernel config. i *highly* recommend including it unless you have a very compelling reason not to.
-j

Also, using bash -x did show that the script falls over at the '-m state' rule...

Steve

Signature · 6 lines

Steve Turnbull
Digital Content Developer
YHGfL Foundation

t 01724 275030
e [email protected]

Jose Maria Lopez

2004-09-05 16:41 UTC #4 lore raw

In reply to Steve Turnbull

Quoted 10 lines · Steve Turnbull

Hi
Our web server is configured;
Debian (Woody) (No X installed)
Kernel 2.4.23 - configured with iptables in mind
iptables v1.2.6a
When we start the firewall script, we get this message; 'No chain/target/match by that name'

You should check your firewall script and find the rule that it's giving the error, just run it with "bash -x <script>" and you can see line by line what's happening. Maybe it's a misspelling of a rule.

Quoted 6 lines

The firewall works however, but is constantly logging; 'Sep 5 16:00:52 www kernel: Input: IN=eth0 OUT= MAC=00:e0:81:29:01:75:00:07:85:06:c2:e1:08:00 SRC=195.92.195.93 DST=195.92.38.54 LEN=302 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=53 DPT=32833 LEN=282'

This is DNS normal traffic I think, so you shouldn't be logging it.

Quoted 4 lines

Something is ammis here, and we can't ping out from the server with the firewall running, also, we can't use Lynx to browse. Turn the firewall off and all is well for both of these.

If you turn the policy to deny and then the firewall script gives an error and exits then you don't have the ports you need open and that's the problem.

Quoted 55 lines

Has anybody got any ideas what is wrong? Our firewall rule is below.
Regards
Steve
#!/bin/sh
#
# This is the firewall up script.
#
#
# Lets start by dropping all incoming traffic and allowing all
# outbound traffic
#
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# Flush any existing rules...
iptables -F
# Allow any established connections to come on through... iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# This is a web server. We only require access to http ports # 80,21,53 and 443. New ports to allow will be added here... iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT
#ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#ftp
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
#DNS
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
# Allow the loopback connection...
iptables -A INPUT -i lo -j ACCEPT
# Log stuff that doesn't match above rules...
iptables -A INPUT -j LOG --log-prefix="Input: "

Signature · 12 lines

Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
[email protected]
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"

Alistair Tonner

2004-09-05 17:51 UTC #5 lore raw

In reply to Steve Turnbull

Quoted 9 lines · Steve Turnbull

Hi
Our web server is configured;
Debian (Woody) (No X installed)
Kernel 2.4.23 - configured with iptables in mind
iptables v1.2.6a
When we start the firewall script, we get this message; 'No chain/target/match by that name'

urmm ... try rebuilding iptables code against this kernel?

I'm not sure about Debian's packages, but is it possible that the iptables
code is precompiled here?

Quoted 6 lines

The firewall works however, but is constantly logging; 'Sep 5 16:00:52 www kernel: Input: IN=eth0 OUT= MAC=00:e0:81:29:01:75:00:07:85:06:c2:e1:08:00 SRC=195.92.195.93 DST=195.92.38.54 LEN=302 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=53 DPT=32833 LEN=282'

This looks like a reply to a DNS query. It the state rule below didn't get
accepted this looks correct.

Quoted 4 lines

Something is ammis here, and we can't ping out from the server with the firewall running, also, we can't use Lynx to browse. Turn the firewall off and all is well for both of these.

You haven't included any rules here that regard ICMP -- no pings.

Quoted 56 lines

Has anybody got any ideas what is wrong? Our firewall rule is below.
Regards
Steve
#!/bin/sh
#
# This is the firewall up script.
#
#
# Lets start by dropping all incoming traffic and allowing all
# outbound traffic
#
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# Flush any existing rules...
iptables -F
# Allow any established connections to come on through... iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# This is a web server. We only require access to http ports # 80,21,53 and 443. New ports to allow will be added here... iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT
#ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#ftp
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
#DNS
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
# Allow the loopback connection...
iptables -A INPUT -i lo -j ACCEPT
# Log stuff that doesn't match above rules...
iptables -A INPUT -j LOG --log-prefix="Input: "

Steve Turnbull

author

2004-09-05 18:32 UTC #6 lore raw

Quoted 9 lines · Alistair Tonner

Quoted 7 lines · Steve Turnbull
Hi
Our web server is configured;
Debian (Woody) (No X installed)
Kernel 2.4.23 - configured with iptables in mind
iptables v1.2.6a

Quoted 8 lines

Quoted 2 lines
When we start the firewall script, we get this message; 'No chain/target/match by that name'
urmm ... try rebuilding iptables code against this kernel?
I'm not sure about Debian's packages, but is it possible that the iptables
code is precompiled here?

I have just rebuilt the Kernel - I daren't reboot into it until I am on
site tomorrow - we will see what happens, I have added various components along side the existing ones.

Quoted 13 lines

Quoted 7 lines
The firewall works however, but is constantly logging; 'Sep 5 16:00:52 www kernel: Input: IN=eth0 OUT= MAC=00:e0:81:29:01:75:00:07:85:06:c2:e1:08:00 SRC=195.92.195.93 DST=195.92.38.54 LEN=302 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=53 DPT=32833 LEN=282'
This looks like a reply to a DNS query. It the state rule below didn't get
accepted this looks correct.

Quoted 6 lines

Quoted 3 lines
Something is ammis here, and we can't ping out from the server with the firewall running, also, we can't use Lynx to browse. Turn the firewall off and all is well for both of these.
You haven't included any rules here that regard ICMP -- no pings.

I was meaning I couldn't ping out FROM the server. The rule for
outgoing traffic is accept all - "iptables -P OUTPUT ACCEPT", this is why I was confused about the inability to ping or browse with Lynx outbound.

Quoted 59 lines

Quoted 57 lines
Has anybody got any ideas what is wrong? Our firewall rule is below.
Regards
Steve
#!/bin/sh
#
# This is the firewall up script.
#
#
# Lets start by dropping all incoming traffic and allowing all
# outbound traffic
#
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# Flush any existing rules...
iptables -F
# Allow any established connections to come on through... iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# This is a web server. We only require access to http ports # 80,21,53 and 443. New ports to allow will be added here... iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT
#ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#ftp
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
#DNS
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
# Allow the loopback connection...
iptables -A INPUT -i lo -j ACCEPT
# Log stuff that doesn't match above rules...
iptables -A INPUT -j LOG --log-prefix="Input: "

Signature · 6 lines

Steve Turnbull
Digital Content Developer
YHGfL Foundation

t 01724 275030
e [email protected]

Steve Turnbull

author

2004-09-06 23:38 UTC #7 lore raw

In reply to Alistair Tonner

Quoted 30 lines · Alistair Tonner

Quoted 9 lines · Steve Turnbull
Hi
Our web server is configured;
Debian (Woody) (No X installed)
Kernel 2.4.23 - configured with iptables in mind
iptables v1.2.6a
When we start the firewall script, we get this message; 'No chain/target/match by that name'
urmm ... try rebuilding iptables code against this kernel?
I'm not sure about Debian's packages, but is it possible that the iptables
code is precompiled here?
Quoted 5 lines
The firewall works however, but is constantly logging; 'Sep 5 16:00:52 www kernel: Input: IN=eth0 OUT= MAC=00:e0:81:29:01:75:00:07:85:06:c2:e1:08:00 SRC=195.92.195.93 DST=195.92.38.54 LEN=302 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=53 DPT=32833 LEN=282'
This looks like a reply to a DNS query. It the state rule below didn't get
accepted this looks correct.

Quoted 65 lines

Quoted 3 lines
Something is ammis here, and we can't ping out from the server with the firewall running, also, we can't use Lynx to browse. Turn the firewall off and all is well for both of these.
You haven't included any rules here that regard ICMP -- no pings.
Quoted 55 lines
Has anybody got any ideas what is wrong? Our firewall rule is below.
Regards
Steve
#!/bin/sh
#
# This is the firewall up script.
#
#
# Lets start by dropping all incoming traffic and allowing all
# outbound traffic
#
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# Flush any existing rules...
iptables -F
# Allow any established connections to come on through... iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# This is a web server. We only require access to http ports # 80,21,53 and 443. New ports to allow will be added here... iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT
#ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#ftp
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
#DNS
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
# Allow the loopback connection...
iptables -A INPUT -i lo -j ACCEPT
# Log stuff that doesn't match above rules...
iptables -A INPUT -j LOG --log-prefix="Input: "

Turns out that it just needed some exra stuff comiling into the kernel - I added all of the state options and all is well now, thanks for he help

Steve

Signature · 6 lines

Steve Turnbull
Digital Content Developer
YHGfL Foundation

t 01724 275030
e [email protected]