| View previous topic :: View next topic |
| Author |
Message |
Philippe23
Tux's lil' helper
Joined: 20 Dec 2006
Posts: 130
Location: Central NY
|
 Posted: Tue May 15, 2012 12:29 pm Post subject: iptables complaining about no "icmp" extension fou |
 |
|
When I restart iptables, I'm getting this error:
| Code: | | /usr/lib64/xtables/libipt_icmp.so: no "icmp" extension found for this protocol |
Can anyone decode for me what it's complaining about? Am I missing a kernel option or something else?
| Code: | :icmp - [0:0]
[45:2160] -A INPUT -s 169.254.0.0/16 -j REJECT --reject-with icmp-port-unreachable
[341:19312] -A INPUT -s 172.16.0.0/12 -j REJECT --reject-with icmp-port-unreachable
[12595:1442565] -A INPUT -p icmp -j icmp
[2608:139281] -A icmp -p icmp -m icmp --icmp-type 8 -j ACCEPT
[1:96] -A icmp -p icmp -m icmp --icmp-type 3/4 -j ACCEPT
[9874:1295355] -A icmp -p icmp -m icmp --icmp-type 3 -j ACCEPT
[0:0] -A icmp -p icmp -m icmp --icmp-type 4 -j ACCEPT
[0:0] -A icmp -p icmp -m icmp --icmp-type 12 -j ACCEPT
[73:4852] -A icmp -p icmp -m icmp --icmp-type 11 -j ACCEPT
[22:1616] -A icmp -p icmp -j DROP |
|
|
| Back to top |
|
 |
Thistled
Guru
Joined: 06 Jan 2011
Posts: 572
Location: Scotland
|
| Posted: Sun May 20, 2012 6:09 pm Post subject: |
|
|
Hi Philippe23
I might be totally crazy for asking this but, have you enabled Xtables in your kernel?
In the kernel config, you will find it here:
| Code: | Networking support
-> Networking options
-> Network packet filtering framework
-> Core Netfilter Configuration |
_________________
Whatever you do, do it properly! |
|
| Back to top |
|
|
Philippe23
Tux's lil' helper
Joined: 20 Dec 2006
Posts: 130
Location: Central NY
|
| Posted: Sun May 20, 2012 6:31 pm Post subject: |
|
|
I'm pretty sure it is: CONFIG_NETFILTER_XTABLES=y
| Code: | #
# Core Netfilter Configuration
#
CONFIG_NETFILTER_NETLINK=y
CONFIG_NETFILTER_NETLINK_QUEUE=y
CONFIG_NETFILTER_NETLINK_LOG=y
CONFIG_NF_CONNTRACK=y
CONFIG_NF_CONNTRACK_MARK=y
CONFIG_NF_CONNTRACK_SECMARK=y
CONFIG_NF_CONNTRACK_EVENTS=y
CONFIG_NF_CONNTRACK_TIMESTAMP=y
# CONFIG_NF_CT_PROTO_DCCP is not set
# CONFIG_NF_CT_PROTO_SCTP is not set
# CONFIG_NF_CT_PROTO_UDPLITE is not set
# CONFIG_NF_CONNTRACK_AMANDA is not set
CONFIG_NF_CONNTRACK_FTP=y
# CONFIG_NF_CONNTRACK_H323 is not set
CONFIG_NF_CONNTRACK_IRC=y
CONFIG_NF_CONNTRACK_BROADCAST=m
CONFIG_NF_CONNTRACK_NETBIOS_NS=m
CONFIG_NF_CONNTRACK_SNMP=m
# CONFIG_NF_CONNTRACK_PPTP is not set
# CONFIG_NF_CONNTRACK_SANE is not set
# CONFIG_NF_CONNTRACK_SIP is not set
# CONFIG_NF_CONNTRACK_TFTP is not set
CONFIG_NF_CT_NETLINK=y
# CONFIG_NETFILTER_TPROXY is not set
CONFIG_NETFILTER_XTABLES=y
#
# Xtables combined modules
#
CONFIG_NETFILTER_XT_MARK=y
CONFIG_NETFILTER_XT_CONNMARK=y
#
# Xtables targets
#
# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set
# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set
CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y
# CONFIG_NETFILTER_XT_TARGET_CT is not set
# CONFIG_NETFILTER_XT_TARGET_DSCP is not set
# CONFIG_NETFILTER_XT_TARGET_HL is not set
CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
CONFIG_NETFILTER_XT_TARGET_LED=y
CONFIG_NETFILTER_XT_TARGET_MARK=y
CONFIG_NETFILTER_XT_TARGET_NFLOG=y
CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
# CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set
CONFIG_NETFILTER_XT_TARGET_RATEEST=y
# CONFIG_NETFILTER_XT_TARGET_TEE is not set
# CONFIG_NETFILTER_XT_TARGET_TRACE is not set
CONFIG_NETFILTER_XT_TARGET_SECMARK=y
# CONFIG_NETFILTER_XT_TARGET_TCPMSS is not set
# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
# Xtables matches
#
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
# CONFIG_NETFILTER_XT_MATCH_CLUSTER is not set
CONFIG_NETFILTER_XT_MATCH_COMMENT=y
CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y
CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y
CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
# CONFIG_NETFILTER_XT_MATCH_CPU is not set
# CONFIG_NETFILTER_XT_MATCH_DCCP is not set
# CONFIG_NETFILTER_XT_MATCH_DEVGROUP is not set
# CONFIG_NETFILTER_XT_MATCH_DSCP is not set
# CONFIG_NETFILTER_XT_MATCH_ESP is not set
CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y
CONFIG_NETFILTER_XT_MATCH_HELPER=y
# CONFIG_NETFILTER_XT_MATCH_HL is not set
CONFIG_NETFILTER_XT_MATCH_IPRANGE=y
CONFIG_NETFILTER_XT_MATCH_LENGTH=y
CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=y
CONFIG_NETFILTER_XT_MATCH_MARK=y
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
# CONFIG_NETFILTER_XT_MATCH_OSF is not set
CONFIG_NETFILTER_XT_MATCH_OWNER=y
CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y
CONFIG_NETFILTER_XT_MATCH_QUOTA=y
CONFIG_NETFILTER_XT_MATCH_RATEEST=y
CONFIG_NETFILTER_XT_MATCH_REALM=y
CONFIG_NETFILTER_XT_MATCH_RECENT=y
# CONFIG_NETFILTER_XT_MATCH_SCTP is not set
CONFIG_NETFILTER_XT_MATCH_STATE=y
CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
CONFIG_NETFILTER_XT_MATCH_STRING=y
# CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set
CONFIG_NETFILTER_XT_MATCH_TIME=y
CONFIG_NETFILTER_XT_MATCH_U32=y
# CONFIG_IP_SET is not set
# CONFIG_IP_VS is not set
#
# IP: Netfilter Configuration
#
CONFIG_NF_DEFRAG_IPV4=y
CONFIG_NF_CONNTRACK_IPV4=y
CONFIG_NF_CONNTRACK_PROC_COMPAT=y
# CONFIG_IP_NF_QUEUE is not set
CONFIG_IP_NF_IPTABLES=y
# CONFIG_IP_NF_MATCH_AH is not set
# CONFIG_IP_NF_MATCH_ECN is not set
# CONFIG_IP_NF_MATCH_TTL is not set
CONFIG_IP_NF_FILTER=y
CONFIG_IP_NF_TARGET_REJECT=y
CONFIG_IP_NF_TARGET_LOG=y
CONFIG_IP_NF_TARGET_ULOG=m
CONFIG_NF_NAT=m
CONFIG_NF_NAT_NEEDED=y
CONFIG_IP_NF_TARGET_MASQUERADE=m
# CONFIG_IP_NF_TARGET_NETMAP is not set
CONFIG_IP_NF_TARGET_REDIRECT=m
# CONFIG_NF_NAT_SNMP_BASIC is not set
CONFIG_NF_NAT_FTP=m
CONFIG_NF_NAT_IRC=m
# CONFIG_NF_NAT_TFTP is not set
# CONFIG_NF_NAT_AMANDA is not set
# CONFIG_NF_NAT_PPTP is not set
# CONFIG_NF_NAT_H323 is not set
# CONFIG_NF_NAT_SIP is not set
CONFIG_IP_NF_MANGLE=y
# CONFIG_IP_NF_TARGET_CLUSTERIP is not set
# CONFIG_IP_NF_TARGET_ECN is not set
# CONFIG_IP_NF_TARGET_TTL is not set
CONFIG_IP_NF_RAW=y
CONFIG_IP_NF_SECURITY=y
CONFIG_IP_NF_ARPTABLES=y
CONFIG_IP_NF_ARPFILTER=y
CONFIG_IP_NF_ARP_MANGLE=y
# CONFIG_IP_DCCP is not set
# CONFIG_IP_SCTP is not set
# CONFIG_RDS is not set
# CONFIG_TIPC is not set
# CONFIG_ATM is not set
# CONFIG_L2TP is not set
# CONFIG_BRIDGE is not set
# CONFIG_NET_DSA is not set
# CONFIG_VLAN_8021Q is not set
# CONFIG_DECNET is not set
CONFIG_LLC=m
# CONFIG_LLC2 is not set
CONFIG_IPX=m
# CONFIG_IPX_INTERN is not set
CONFIG_ATALK=m
# CONFIG_DEV_APPLETALK is not set
# CONFIG_X25 is not set
# CONFIG_LAPB is not set
# CONFIG_WAN_ROUTER is not set
# CONFIG_PHONET is not set
# CONFIG_IEEE802154 is not set
CONFIG_NET_SCHED=y |
|
|
| Back to top |
|
|
cach0rr0
Bodhisattva
Joined: 13 Nov 2008
Posts: 4123
Location: Houston, Republic of Texas
|
| Posted: Mon May 21, 2012 2:56 am Post subject: Re: iptables complaining about no "icmp" extension |
|
|
| Philippe23 wrote: | | Code: | | [12595:1442565] -A INPUT -p icmp -j icmp |
|
shouldn't this be -j ACCEPT or some other chain? I don't think -j icmp is valid
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash |
|
| Back to top |
|
|
Philippe23
Tux's lil' helper
Joined: 20 Dec 2006
Posts: 130
Location: Central NY
|
| Posted: Mon May 21, 2012 11:33 am Post subject: |
|
|
| "icmp" is the name of my chain that deals with ICMP traffic. |
|
| Back to top |
|
|
Napalm Llama
Guru
Joined: 04 Jun 2005
Posts: 533
Location: Cardiff, UK
|
| Posted: Sun Oct 28, 2012 3:08 pm Post subject: |
|
|
I'm getting this as well; did you ever figure out what was causing it?
_________________
Ryzen 5600x; Asus TUF Gaming B550-Plus; Geforce 1660 Super
Registered Linux User #381314
# killall humans |
|
| Back to top |
|
|
Philippe23
Tux's lil' helper
Joined: 20 Dec 2006
Posts: 130
Location: Central NY
|
| Posted: Sun Oct 28, 2012 10:14 pm Post subject: |
|
|
| Nope. I still get it. |
|
| Back to top |
|
|
wcg
Guru
Joined: 06 Jan 2009
Posts: 588
|
| Posted: Mon Oct 29, 2012 4:12 pm Post subject: |
|
|
Who is complaining, iptables or the kernel (what is the source of the error
message)? If it is iptables, you should be able to strace it or run it in
gdb (emerge it with debug information enabled in CFLAGS first, don't
strip it, etc; -ggdb in CFLAGS and FEATURES="splitdebug" in
/etc/portage/make.conf is handy for this) and see what iptables
function is complaining, what it is looking for and not finding, etc.
http://www.gentoo.org/proj/en/qa/backtraces.xml
_________________
TIA |
|
| Back to top |
|
|
|
Networking & Security
