iptables: No chain/target/match by that name ...

[jlmcp]

All,

So, I spent several hours with the Gentoo Wiki(s):

"Iptables for n00bs" - http://gentoo-wiki.com/HOWTO_Iptables_for_newbies
"HOWTO iptables & stateful firewalls" - http://gentoo-wiki.com/HOWTO_Iptables_a ... _firewalls

... and everything seems to work, except the following two rules I pulled from an example in the latter resource:

Code: Select all

iptables -A INPUT -p tcp -i eth0 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp -i eth0 -j REJECT --reject-with icmp-port-unreachable

All the rules preceding and following load just fine, but for these two, I get the error:

Code: Select all

iptables: No chain/target/match by that name

Checked the syntax seven ways from Sunday with the iptables man page, et al, but I still get the error.

Hints?

[jtaylor72]

I had this problem when getting this going as well. Check back and make sure you have all the options enabled in the kernel that the guide mentions. I was missing one when I did it.

[jlmcp]

Thanks for the tip ... you were right.

The main problem is, the aforementioned wiki's are not updated for the peculiarities of how netfilter was implemented in the 2.6.20 kernel, which makes following their instructions somewhat problematic. After a few more hours on the forums here, I was able to figure out how to enable the desired kernel modules, some of which had to be manually switched on in the .config vs. "make menuconfig" before they would appear ... extremely annoying.

If this helps anyone, here are the options I have enabled in my 2.6.20 kernel to enable netfilter/iptables. (Note: some of the options below may be unneeded; just haven't had the time to investigate exactly what each does in order to rule them out.)

Comments definitely welcome!)

Code: Select all

Networking  --->
 Networking options  --->
  [*] Network packet filtering framework (Netfilter) --->

Core Netfilter Configuration  ---> 
 <*> Netfilter netlink interface
    <*> Netfilter NFQUEUE over NFNETLINK interface  
    <*> Netfilter LOG over NFNETLINK interface
 [*] Connection tracking flow accounting
 [*] Connection mark tracking support
 [*] Connection tracking events (EXPERIMENTAL)
 <*> Connection tracking netlink interface (EXPERIMENTAL) 
 <*> Netfilter Xtables support (required for ip_tables)
    <*> "connbytes" per-connection counter match support
    <*> "connmark" connection mark match support
    <*> "conntrack" connection tracking match support
    <*> "state" match support
    <*> "helper" match support

IP: Netfilter Configuration  --->
 <*> IPv4 connection tracking support (required for NAT)
    [*] proc/sysctl compatibility with old connection tracking
 <*> IP tables support (required for filtering/masq/NAT)
    < > ECN match support
    <*> Packet filtering
       <*> REJECT target support
    <*> LOG target support
    <*> Full NAT
 <*> MASQUERADE target support  

Cheers,

Jake

[jtaylor72]

I'm glad I was able to point you in the right direction. It was too long ago for me to remember what the kernel options were, but I had the same experience, finding the right options in the 2.6 when the wiki was for the 2.4.

[madman2003]

Thanks as well, was usefull.