iplimit module refuses to work

iplimit module refuses to work

[cmbb]

I can't get the iplimit module to work for me,
this is an SMP AMD machine.

# iptables -A TcpLimit -m iplimit --iplimit-above 125 -j OverX

iptables: Invalid argument

strace -f ...

Re: iplimit module refuses to work

[Cedric Blancher]

Le lun 11/08/2003 à 19:26, cmbb@dslr.net a écrit :
> I can't get the iplimit module to work for me,
> this is an SMP AMD machine.
> # iptables -A TcpLimit -m iplimit --iplimit-above 125 -j OverX
> iptables: Invalid argument

Is your running kernel built with iplimit support ?

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE

Re[3]: iplimit module refuses to work

[cmbb]

CONFIG_IP_NF_MATCH_IPLIMIT=m

um, is there another secret hidden option, not checked, that has to be
turned on before the iplimit module will work, even though it compiles
ok as a module and can be insmod'd ok?

CB>> Is your running kernel built with iplimit support ?

Re: iplimit module refuses to work

[Ramin Dousti]

On Mon, Aug 11, 2003 at 01:26:40PM -0400, cmbb@dslr.net wrote:

> 
> I can't get the iplimit module to work for me,
> this is an SMP AMD machine.
> 
> # iptables -A TcpLimit -m iplimit --iplimit-above 125 -j OverX

Do you have OverX and TcpLimit as chains?

Ramin

> 
> iptables: Invalid argument
> 
> strace -f ...
> 

Re: Re[3]: iplimit module refuses to work

[Cedric Blancher]

Le lun 11/08/2003 à 20:12, cmbb@dslr.net a écrit :
> CONFIG_IP_NF_MATCH_IPLIMIT=m
> um, is there another secret hidden option, not checked, that has to be
> turned on before the iplimit module will work, even though it compiles
> ok as a module and can be insmod'd ok?

Well, there's no secret option, but usually, this kind of error occurs
when iptables has been built with options kernel does not support. But
it does not seem to be the case here.

It can also occurs when your kernel side Netfilter stuff version is too
different from iptables one. I don't use iplimit, so I may be wrong, but
sometimes, your iptables version can have options for a match that your
kernel module does not support, because it's too old, or options is
deprecated. I had the case with ROUTE target, and got this error.

Just my, maybe pointless, 0.02¤...

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE

Re[2]: iplimit module refuses to work

[justin]

yes I do ..  and other modules work just fine, as does the firewall.

The only problem is iplimit flunking out with this unknown error.

Its not even like its explaining what socket option is failing, nor are
there any console messages from the kernel as it rejects the bogus
socket option call.

Chain CloseY (1 references)
target     prot opt source               destination
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0          tcp flags:0x16/0x02
REJECT     tcp  --  0.0.0.0/0            0.0.0.0/0          recent: UPDATE seconds: 1 hit_count: 10 name: Close side: source reject-with tcp-reset
DROP       all  --  0.0.0.0/0            0.0.0.0/0

Chain OverX (0 references)
target     prot opt source               destination
           all  --  0.0.0.0/0            0.0.0.0/0          recent: SET name: Last side: source
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0          tcp flags:0x16/0x02 #conn/32 > 125
RETURN     all  --  0.0.0.0/0            0.0.0.0/0          recent: CHECK seconds: 60 name: First side: source
CloseY     all  --  0.0.0.0/0            0.0.0.0/0          recent: CHECK name: First side: source
RETURN     all  --  0.0.0.0/0            0.0.0.0/0          recent: CHECK name: First side: source
           all  --  0.0.0.0/0            0.0.0.0/0          recent: SET name: First side: source

Chain TcpLimit (0 references)
target     prot opt source               destination
RETURN     tcp  --  0.0.0.0/0            0.0.0.0/0          tcp flags:0x04/0x04
RETURN     tcp  --  0.0.0.0/0            0.0.0.0/0          tcp flags:0x01/0x01

Chain UnderX (0 references)
target     prot opt source               destination
RETURN     all  --  0.0.0.0/0            0.0.0.0/0          recent: CHECK seconds: 60 name: Last side: source
           all  --  0.0.0.0/0            0.0.0.0/0          recent: REMOVE name: Last side: source
           all  --  0.0.0.0/0            0.0.0.0/0          recent: REMOVE name: First side: source



>> 
>> I can't get the iplimit module to work for me,
>> this is an SMP AMD machine.
>> 
>> # iptables -A TcpLimit -m iplimit --iplimit-above 125 -j OverX

RD> Do you have OverX and TcpLimit as chains?

RD> Ramin

>> 
>> iptables: Invalid argument
>> 
>> strace -f ...
>>