iptables ERROR

iptables ERROR

[Ritesh Majumdar]

Hello List,

I have recently added ipset code in to my kernel, so all the ipset
ralated ko's can be compiled while I compile kernel.
my compilation works fine and I can add ipset rules successfully.
but when I add iptables rules to macth specific set I get error.

Here is what I am trying to do.



ipset -N a_ipset iphash 
iptables -N a 
iptables -N b 
iptables -A a -p udp -m set --set a_ipset dst -j b 





when I try to add the last rule,(iptables -A a -p udp -m set --set
a_ipset dst -j b)  it fails with the error as below.

iptables: Invalid argument



I am not sure if its ipset issue or iptables.

I am using "kernel 2.6.27" "ipset-2.4.9" and "iptables-1.4.1.91"


Many Thanks.
Ritesh.

Re: iptables ERROR

[Richard Horton]

2009/6/25 Ritesh Majumdar <r.majumdar@globallogic.com>:
>
> ipset -N a_ipset iphash
> iptables -N a
> iptables -N b
> iptables -A a -p udp -m set --set a_ipset dst -j b
>

Isn't it meant to be:-
iptables -A a -p udp -m set --set a_ipset,dst -j b

(note the insertion of a comma)
-- 
Richard Horton
Users are like a virus: Each causing a thousand tiny crises until the
host finally dies.
http://www.solstans.co.uk - Solstans Japanese Bobtails and Norwegian Forest Cats
http://www.pbase.com/arimus - My online photogallery

Re: iptables ERROR

[Ritesh Majumdar]

Hello,

As per my earlier mail.

Here is error I get on my /var/log/messages.

kernel: ip_tables: set match: invalid size 96 != 32



Thanks,




On Thu, 2009-06-25 at 18:26 +0530, Ritesh Majumdar wrote:
> Hello List,
> 
> I have recently added ipset code in to my kernel, so all the ipset
> ralated ko's can be compiled while I compile kernel.
> my compilation works fine and I can add ipset rules successfully.
> but when I add iptables rules to macth specific set I get error.
> 
> Here is what I am trying to do.
> 
> 
> 
> ipset -N a_ipset iphash 
> iptables -N a 
> iptables -N b 
> iptables -A a -p udp -m set --set a_ipset dst -j b 
> 
> 
> 
> 
> 
> when I try to add the last rule,(iptables -A a -p udp -m set --set
> a_ipset dst -j b)  it fails with the error as below.
> 
> iptables: Invalid argument
> 
> 
> 
> I am not sure if its ipset issue or iptables.
> 
> I am using "kernel 2.6.27" "ipset-2.4.9" and "iptables-1.4.1.91"
> 
> 
> Many Thanks.
> Ritesh.
> 
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: iptables ERROR

[Jan Engelhardt]

On Thursday 2009-06-25 16:00, Ritesh Majumdar wrote:

>Hello,
>
>As per my earlier mail.
>
>Here is error I get on my /var/log/messages.
>
>kernel: ip_tables: set match: invalid size 96 != 32

This could be related to http://markmail.org/message/dijxb6i6325t6hge
So be sure to use ipset 3.0 (it's out now) with iptables 1.4.4.

Re: iptables ERROR

[Jozsef Kadlecsik]

On Thu, 25 Jun 2009, Jan Engelhardt wrote:

> On Thursday 2009-06-25 16:00, Ritesh Majumdar wrote:
> 
> >As per my earlier mail.
> >
> >Here is error I get on my /var/log/messages.
> >
> >kernel: ip_tables: set match: invalid size 96 != 32
> 
> This could be related to http://markmail.org/message/dijxb6i6325t6hge
> So be sure to use ipset 3.0 (it's out now) with iptables 1.4.4.

Yes, exactly: with ipset 3.0 you need iptables 1.4.4.

I'm sorry for breaking backward compatibility.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

iptables error

[Nishit Shah]

Hi,
	I am using 2.6.16.13 kernel in smp configuration. Machine is working
as a gateway and frequent iptables commands are fired as users logged in and
logged out.

      I got following error in between

[root@manage /root]# iptables -nvx -L INPUT
ERROR: 7 not a valid target)
Aborted (core dumped)

So, I tried to flush INPUT and got following

[root@manage /root]# iptables -F INPUT 
iptables: Too many levels of symbolic links

following is a message I got in /var/log/messages

Aug 26 14:38:30 1219741710 kernel: iptables: loop hook 1 pos 0 00000022.

Rgds,
Nishit Shah.        

Re: iptables error

[Patrick McHardy]

Nishit Shah wrote:
> Hi,
> 	I am using 2.6.16.13 kernel in smp configuration. Machine is working
> as a gateway and frequent iptables commands are fired as users logged in and
> logged out.
> 
>       I got following error in between
> 
> [root@manage /root]# iptables -nvx -L INPUT
> ERROR: 7 not a valid target)
> Aborted (core dumped)
> 
> So, I tried to flush INPUT and got following
> 
> [root@manage /root]# iptables -F INPUT 
> iptables: Too many levels of symbolic links
> 
> following is a message I got in /var/log/messages
> 
> Aug 26 14:38:30 1219741710 kernel: iptables: loop hook 1 pos 0 00000022.

That kernel version has an iptables locking bug that might
lead to corruption. Latest 2.6.16 version has this fixed.

RE: iptables error

[Nishit Shah]

Thanks :)

Rgds,
Nishit Shah.

-----Original Message-----
From: Patrick McHardy [mailto:kaber@trash.net] 
Sent: Monday, September 01, 2008 7:08 PM
To: Nishit Shah
Cc: netfilter-devel@vger.kernel.org
Subject: Re: iptables error

Nishit Shah wrote:
> Hi,
> 	I am using 2.6.16.13 kernel in smp configuration. Machine is working
> as a gateway and frequent iptables commands are fired as users logged in
and
> logged out.
> 
>       I got following error in between
> 
> [root@manage /root]# iptables -nvx -L INPUT
> ERROR: 7 not a valid target)
> Aborted (core dumped)
> 
> So, I tried to flush INPUT and got following
> 
> [root@manage /root]# iptables -F INPUT 
> iptables: Too many levels of symbolic links
> 
> following is a message I got in /var/log/messages
> 
> Aug 26 14:38:30 1219741710 kernel: iptables: loop hook 1 pos 0 00000022.

That kernel version has an iptables locking bug that might
lead to corruption. Latest 2.6.16 version has this fixed.