From mboxrd@z Thu Jan 1 00:00:00 1970 From: "jelenkovic" Subject: iptables error Date: Tue, 12 Nov 2002 01:07:34 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <001201c289df$80e81180$286bfea9@OBLIVION> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000F_01C289E7.E273DD50" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_000F_01C289E7.E273DD50 Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable ok i'm having problems with the new iptables and 1.4.19 kernel. here is the log error: Nov 11 04:55:29 BAKER kernel: ASSERT ip_conntrack_core.c:1063 = &ip_conntrack_lock not readlocked Nov 11 04:55:29 BAKER kernel: ASSERT: ip_nat_core.c:839 = &ip_conntrack_lock not readlocked and then this is what happens later at some point: Nov 11 20:57:58 BAKER kernel: IPTABLES Dead Input: IN=3Deth0 OUT=3D = MAC=3D00:50:04:55:d1:a4:00:02:4b:13:33:60:08:00 SRC=3D213.250.59.123 = DST=3D************ LEN=3D48 TOS=3D0x00 PREC=3D0x00 TTL=3D125 ID=3D19471 = DF PROTO=3DTCP SPT=3D4682 DPT=3D10 WINDOW=3D16384 RES=3D0x00 SYN = URGP=3D0=20 notice that the destination port is 10.it shows that for all ports i = think? this was logged when i tried to use the web server. so it should have recognized port 80 and not logged anything. I've seen other ppl having the same problem (searched google) but no one = knows what the problem might be. any ideas? ------=_NextPart_000_000F_01C289E7.E273DD50 Content-Type: text/html; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable

ok i'm having problems with the new = iptables and=20 1.4.19 kernel.

here is the log error:

Nov 11 04:55:29 BAKER kernel: ASSERT=20 ip_conntrack_core.c:1063 &ip_conntrack_lock not readlocked
Nov 11 = 04:55:29 BAKER kernel: ASSERT: ip_nat_core.c:839 &ip_conntrack_lock = not=20 readlocked

and then this is what happens later at = some=20 point:

Nov 11 20:57:58 BAKER kernel: IPTABLES = Dead Input:=20 IN=3Deth0 OUT=3D MAC=3D00:50:04:55:d1:a4:00:02:4b:13:33:60:08:00 = SRC=3D213.250.59.123=20 DST=3D************ LEN=3D48 TOS=3D0x00 PREC=3D0x00 TTL=3D125 ID=3D19471 = DF PROTO=3DTCP=20 SPT=3D4682 DPT=3D10 WINDOW=3D16384 RES=3D0x00 SYN URGP=3D0

notice that the destination port is = 10.it shows=20 that for all ports i think?

this was logged when i tried to use the = web=20 server.

so it should have recognized port 80 = and not logged=20 anything.

I've seen other ppl having the same = problem=20 (searched google) but no one knows what the problem might = be.

any ideas?

------=_NextPart_000_000F_01C289E7.E273DD50-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Jerry Rasmussen" Subject: IPTables error Date: Wed, 14 Jan 2004 19:08:45 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <217D777D3789FC4591199BA41FB0617A0101EB@nemo.scriptthis.net> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org When I try to add a command with eth1:1 get this error 'iptables -t nat -A PREROUTING -p tcp -i $ex_dev -d 216.27.xxx.xx --dport 3389 -j DNAT --to 192.168.xx.xxx Warning: wierd character in interface `eth1:1' (No aliases, :, ! or *)." I have done a good bit of Googleing I am sure there is an easy answer that I am missing any help would be apperciated. I need to have more than 1 ip address on eth1 Thanks Jerry From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: IPTables error Date: Thu, 15 Jan 2004 00:17:23 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200401150017.23259.Antony@Soft-Solutions.co.uk> References: <217D777D3789FC4591199BA41FB0617A0101EB@nemo.scriptthis.net> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <217D777D3789FC4591199BA41FB0617A0101EB@nemo.scriptthis.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Thursday 15 January 2004 12:08 am, Jerry Rasmussen wrote: > When I try to add a command with eth1:1 get this error 'iptables -t nat > -A PREROUTING -p tcp -i $ex_dev -d 216.27.xxx.xx --dport 3389 -j DNAT > --to 192.168.xx.xxx > Warning: wierd character in interface `eth1:1' (No aliases, :, ! or *)." > > I have done a good bit of Googleing I am sure there is an easy answer > that I am missing You are correct. The easy answer is: "leave out the :1 on the interface name". Multiple IPs are still bound to one real interface (this is more obvious if you use the recommended ip addr command instead of ifconfig eth1:1), and your netfilter rules should simply refer to the real interface which the packets come in on. Antony -- This email was created using 100% recycled electrons. Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paulo Andre Subject: Iptables error Date: Wed, 25 Aug 2004 10:19:46 +0200 Sender: netfilter-bounces@lists.netfilter.org Message-ID: <200408251019.46720.pandre@darkstar.nom.za> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org This morning I rebooted one of our firewalls, I have created a new kernel for it (2.4.20, patched kernel with latest p-o-m ng). When I run my firewall script, all I get is errors, seems to be a problem with iptables 'tables' as none of the rules are create but the default policies are in place, in dmesg I have the following error: ip_tables: table screwed up! This firewall is a production server and I can only really take it down tonight to check it, anyone had something like this before? Paulo From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Jason Opperisano" Subject: RE: Iptables error Date: Wed, 25 Aug 2004 08:56:49 -0400 Sender: netfilter-bounces@lists.netfilter.org Message-ID: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-class: urn:content-classes:message List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org > This morning I rebooted one of our firewalls, I have created a new = kernel for > it (2.4.20, patched kernel with latest p-o-m ng). > When I run my firewall script, all I get is errors, seems to be a = problem with > iptables 'tables' as none of the rules are create but the default = policies > are in place, in dmesg I have the following error: > > ip_tables: table screwed up! > > This firewall is a production server and I can only really take it = down > tonight to check it, anyone had something like this before? > > Paulo sounds to me like you applied p-o-m, rebuilt your kernel, but did not = rebuild your userspace. anytime you apply a patch from pom that changes = structures, or requires additional libraries, you need to recompile your = userspace iptables utilities. since it's unclear to me when the = userspace rebuild is required--i do it everytime. sounds like it was in = this case for you... -j From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jose Maria Lopez Subject: RE: Iptables error Date: 25 Aug 2004 21:25:22 +0200 Sender: netfilter-bounces@lists.netfilter.org Message-ID: <1093444934.26740.8.camel@nostromo.bgsecm.com> References: Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="utf-8" To: "netfilter@lists.netfilter.org" El mié, 25 de 08 de 2004 a las 14:56, Jason Opperisano escribió: > > This morning I rebooted one of our firewalls, I have created a new kernel for > > it (2.4.20, patched kernel with latest p-o-m ng). > > When I run my firewall script, all I get is errors, seems to be a problem with > > iptables 'tables' as none of the rules are create but the default policies > > are in place, in dmesg I have the following error: > > > > ip_tables: table screwed up! > > > > This firewall is a production server and I can only really take it down > > tonight to check it, anyone had something like this before? > > > > Paulo > > sounds to me like you applied p-o-m, rebuilt your kernel, but did not rebuild your userspace. anytime you apply a patch from pom that changes structures, or requires additional libraries, you need to recompile your userspace iptables utilities. since it's unclear to me when the userspace rebuild is required--i do it everytime. sounds like it was in this case for you... > > -j > I also agree the problem could be that you have not recompiled the userspace utils, but it's strage, because I think p-o-m use to ask for the iptables sources to be executed. Maybe you have a too old version of iptables or maybe the p-o-m ng it's too new for your quite old (2.4.20) kernel. Why don't updating the iptables to the last version and also the kernel to 2.4.27 so you have to recompile both of them? -- Jose Maria Lopez Hernandez Director Tecnico de bgSEC jkerouac@bgsec.com bgSEC Seguridad y Consultoria de Sistemas Informaticos http://www.bgsec.com ESPAÑA The only people for me are the mad ones -- the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow Roman candles. -- Jack Kerouac, "On the Road" From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ritesh Majumdar Subject: iptables ERROR Date: Thu, 25 Jun 2009 18:26:51 +0530 Message-ID: <1245934611.4518.58.camel@ripper.synapse.com> Mime-Version: 1.0 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="utf-8" To: netfilter@vger.kernel.org, netfilter-devel@vger.kernel.org Hello List, I have recently added ipset code in to my kernel, so all the ipset ralated ko's can be compiled while I compile kernel. my compilation works fine and I can add ipset rules successfully. but when I add iptables rules to macth specific set I get error. Here is what I am trying to do. =EF=BB=BF ipset -N a_ipset iphash=20 iptables -N a=20 iptables -N b=20 iptables -A a -p udp -m set --set a_ipset dst -j b=20 when I try to add the last rule,(=EF=BB=BFiptables -A a -p udp -m set -= -set a_ipset dst -j b) it fails with the error as below. iptables: Invalid argument I am not sure if its ipset issue or iptables. I am using "kernel 2.6.27" "ipset-2.4.9" and "iptables-1.4.1.91" Many Thanks. Ritesh. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Horton Subject: Re: iptables ERROR Date: Thu, 25 Jun 2009 14:39:12 +0100 Message-ID: <56378e320906250639v18ad5fc0q96fef8a2539d59b0@mail.gmail.com> References: <1245934611.4518.58.camel@ripper.synapse.com> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:cc:content-type :content-transfer-encoding; bh=L5nE7QVs0B7de1ZuXEBwanG+vyNtE3SV2r5iPVcMssk=; b=mdmEH+D+INxzchBd+T1SvktmlsO9uHHvC9UELwmTmU4+A2tX/zM3ciRkuFwO6mmAsI bG2wKhHhJDflGM+tUngOQ10dtQV+vnfdEwE8aKRM900dRzXLHEm1yRIRhiqppKF/Zbls Rh+RSVQ6N9/2xmNVPasyd1b65UZloxLE+kPdA= In-Reply-To: <1245934611.4518.58.camel@ripper.synapse.com> Sender: netfilter-devel-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" To: Cc: netfilter@vger.kernel.org, netfilter-devel@vger.kernel.org 2009/6/25 Ritesh Majumdar : > > ipset -N a_ipset iphash > iptables -N a > iptables -N b > iptables -A a -p udp -m set --set a_ipset dst -j b > Isn't it meant to be:- iptables -A a -p udp -m set --set a_ipset,dst -j b (note the insertion of a comma) -- Richard Horton Users are like a virus: Each causing a thousand tiny crises until the host finally dies. http://www.solstans.co.uk - Solstans Japanese Bobtails and Norwegian Forest Cats http://www.pbase.com/arimus - My online photogallery From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ritesh Majumdar Subject: Re: iptables ERROR Date: Thu, 25 Jun 2009 19:30:52 +0530 Message-ID: <1245938452.4518.63.camel@ripper.synapse.com> References: <1245934611.4518.58.camel@ripper.synapse.com> Mime-Version: 1.0 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: In-Reply-To: <1245934611.4518.58.camel@ripper.synapse.com> Sender: netfilter-devel-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="utf-8" To: netfilter@vger.kernel.org Cc: netfilter-devel@vger.kernel.org Hello, As per my earlier mail. Here is error I get on my /var/log/messages. kernel: ip_tables: set match: invalid size 96 !=3D 32 Thanks, On Thu, 2009-06-25 at 18:26 +0530, Ritesh Majumdar wrote: > Hello List, >=20 > I have recently added ipset code in to my kernel, so all the ipset > ralated ko's can be compiled while I compile kernel. > my compilation works fine and I can add ipset rules successfully. > but when I add iptables rules to macth specific set I get error. >=20 > Here is what I am trying to do. >=20 > =EF=BB=BF >=20 > ipset -N a_ipset iphash=20 > iptables -N a=20 > iptables -N b=20 > iptables -A a -p udp -m set --set a_ipset dst -j b=20 >=20 >=20 >=20 >=20 >=20 > when I try to add the last rule,(=EF=BB=BFiptables -A a -p udp -m set= --set > a_ipset dst -j b) it fails with the error as below. >=20 > iptables: Invalid argument >=20 >=20 >=20 > I am not sure if its ipset issue or iptables. >=20 > I am using "kernel 2.6.27" "ipset-2.4.9" and "iptables-1.4.1.91" >=20 >=20 > Many Thanks. > Ritesh. >=20 -- To unsubscribe from this list: send the line "unsubscribe netfilter-dev= el" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jan Engelhardt Subject: Re: iptables ERROR Date: Thu, 25 Jun 2009 17:11:28 +0200 (CEST) Message-ID: References: <1245934611.4518.58.camel@ripper.synapse.com> <1245938452.4518.63.camel@ripper.synapse.com> Mime-Version: 1.0 Return-path: In-Reply-To: <1245938452.4518.63.camel@ripper.synapse.com> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: TEXT/PLAIN; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Ritesh Majumdar Cc: netfilter@vger.kernel.org, netfilter-devel@vger.kernel.org On Thursday 2009-06-25 16:00, Ritesh Majumdar wrote: >Hello, > >As per my earlier mail. > >Here is error I get on my /var/log/messages. > >kernel: ip_tables: set match: invalid size 96 != 32 This could be related to http://markmail.org/message/dijxb6i6325t6hge So be sure to use ipset 3.0 (it's out now) with iptables 1.4.4. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jozsef Kadlecsik Subject: Re: iptables ERROR Date: Thu, 25 Jun 2009 20:08:32 +0200 (CEST) Message-ID: References: <1245934611.4518.58.camel@ripper.synapse.com> <1245938452.4518.63.camel@ripper.synapse.com> Mime-Version: 1.0 Return-path: In-Reply-To: Sender: netfilter-devel-owner@vger.kernel.org List-ID: Content-Type: TEXT/PLAIN; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Jan Engelhardt Cc: Ritesh Majumdar , netfilter@vger.kernel.org, netfilter-devel@vger.kernel.org On Thu, 25 Jun 2009, Jan Engelhardt wrote: > On Thursday 2009-06-25 16:00, Ritesh Majumdar wrote: > > >As per my earlier mail. > > > >Here is error I get on my /var/log/messages. > > > >kernel: ip_tables: set match: invalid size 96 != 32 > > This could be related to http://markmail.org/message/dijxb6i6325t6hge > So be sure to use ipset 3.0 (it's out now) with iptables 1.4.4. Yes, exactly: with ipset 3.0 you need iptables 1.4.4. I'm sorry for breaking backward compatibility. Best regards, Jozsef - E-mail : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary