All of lore.kernel.org
 help / color / mirror / Atom feed
* No chain/target/match by that name
@ 2004-09-05 14:31 Steve Turnbull
  2004-09-05 14:54 ` Jason Opperisano
                   ` (2 more replies)
  0 siblings, 3 replies; 11+ messages in thread
From: Steve Turnbull @ 2004-09-05 14:31 UTC (permalink / raw)
  To: netfilter

Hi

Our web server is configured;
Debian (Woody) (No X installed)
Kernel 2.4.23 - configured with iptables in mind
iptables v1.2.6a

When we start the firewall script, we get this message;
'No chain/target/match by that name'

The firewall works however, but is constantly logging;
'Sep  5 16:00:52 www kernel: Input: IN=eth0 OUT= 
MAC=00:e0:81:29:01:75:00:07:85:06:c2:e1:08:00 SRC=195.92.195.93 
DST=195.92.38.54 LEN=302 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP 
SPT=53 DPT=32833 LEN=282'

Something is ammis here, and we can't ping out from the server with the 
firewall running, also, we can't use Lynx to browse. Turn the firewall 
off and all is well for both of these.

Has anybody got any ideas what is wrong? Our firewall rule is below.

Regards
Steve



#!/bin/sh


#
# This is the firewall up script.
#

#
# Lets start by dropping all incoming traffic and allowing all
# outbound traffic
#

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT



# Flush any existing rules...
iptables -F


# Allow any established connections to come on through...
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


# This is a web server. We only require access to http ports
# 80,21,53 and 443. New ports to allow will be added here...
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

#ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

#ftp
iptables -A INPUT -p tcp --dport 21 -j ACCEPT

#DNS
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT


# Allow the loopback connection...
iptables -A INPUT -i lo -j ACCEPT


# Log stuff that doesn't match above rules...
iptables -A INPUT -j LOG --log-prefix="Input: "

-- 
Steve Turnbull
Digital Content Developer
YHGfL Foundation

t 01724 275030
e steve.turnbull@yhgfl.net



^ permalink raw reply	[flat|nested] 11+ messages in thread
* No chain/target/match by that name
@ 2009-03-17 10:19 Vlad
  2009-03-17 10:20 ` Jan Engelhardt
  0 siblings, 1 reply; 11+ messages in thread
From: Vlad @ 2009-03-17 10:19 UTC (permalink / raw)
  To: netfilter-devel

Hallo , I'm trying to write a new module for iptables. I started with a 
dummy module. I can successfully compile it. But if I trying to use it, 
I get an error message:
 
$ iptables -A INPUT -s 128.0.0.1 -m secan --drop -j DROP
drop frame
iptables: No chain/target/match by that name

Can someone tell me what is a problem? Here is my code:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <getopt.h>
#include <iptables.h>

#include <linux/netfilter_ipv4/ip_tables.h>
#include "libipt_secan.h"

static void secan_help(void)
{
    printf(
"secan options:\n"
"  --drop    Drop Frame\n"
"  --accept    Accept Frame\n");
}

static int secan_parse(int c, char **argv, int invert, unsigned int *flags,
                     const void *entry, struct xt_entry_match **match)
{
    struct ipt_secan_info *info = (struct ipt_secan_info *) (*match)->data;
    switch (c) {
        case '1':
            if (*flags & SECAN_DROP)
            exit_error(PARAMETER_PROBLEM, "Only use --drop once!");
            *flags |= SECAN_DROP;
            info->flags |= SECAN_DROP;
            printf("drop frame\n");
            break;
        case '2':
            if (*flags & SECAN_ACCEPT)
            exit_error(PARAMETER_PROBLEM, "Only use --accept once!");
            *flags |= SECAN_ACCEPT;
            info->flags |= SECAN_ACCEPT;
            printf("accept frame\n");
            break;
        default:
            return 0;

    }

    return 1;
}

static void secan_check(unsigned int flags)
{
    if (!flags)
        exit_error(PARAMETER_PROBLEM,
            "SECAN: You must specify one of "
            "`--drop', `--accept'");
}

static void secan_print(const void *ip, const struct xt_entry_match *match,
                      int numeric)
{
    printf("SECAN match ");
}

static void secan_save(const void *ip, const struct xt_entry_match *match)
{
    const struct ipt_secan_info *info = (struct ipt_secan_info *) 
match->data;

    if (info->flags & SECAN_DROP)
    {
        printf("--drop ");
    }
    if (info->flags & SECAN_ACCEPT)
    {
        printf("--accept ");
    }
    printf("save");
}

static const struct option secan_opts[] = {
    { "drop", 0, NULL, '1' },
    { "accept", 0, NULL, '2'},
    { .name = NULL }
};

static struct xtables_match secan_reg = {
    .name        = "secan",
    .version    = XTABLES_VERSION,
    .family        = PF_INET,
    .size        = XT_ALIGN(sizeof(struct ipt_secan_info)),
    .userspacesize    = XT_ALIGN(sizeof(struct ipt_secan_info)),
    .help        = secan_help,
    .parse        = secan_parse,
    .final_check    = secan_check,
    .print        = secan_print,
    .save        = secan_save,
    .extra_opts    = secan_opts,
};


void _init(void)
{
    xtables_register_match(&secan_reg);
}
 
As I sad this is only a dummy module now and it doesn't do much.

Sincerely,
Vlad


^ permalink raw reply	[flat|nested] 11+ messages in thread
end of thread, other threads:[~2009-03-17 10:45 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-09-05 14:31 No chain/target/match by that name Steve Turnbull
2004-09-05 14:54 ` Jason Opperisano
2004-09-05 15:52   ` Steve Turnbull
2004-09-05 15:55   ` Steve Turnbull
2004-09-05 16:41 ` Jose Maria Lopez
2004-09-05 17:51 ` Alistair Tonner
2004-09-05 18:32   ` Steve Turnbull
2004-09-06 23:38   ` Steve Turnbull
  -- strict thread matches above, loose matches on Subject: below --
2009-03-17 10:19 Vlad
2009-03-17 10:20 ` Jan Engelhardt
     [not found]   ` <49BF7B71.2080801@gmx.net>
     [not found]     ` <alpine.LSU.2.00.0903171131220.18190@fbirervta.pbzchgretzou.qr>
     [not found]       ` <49BF7D72.7010401@gmx.net>
2009-03-17 10:44         ` Jan Engelhardt

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.