logdrop rule does not work any more

logdrop rule does not work any more

[Daniel Dvořák]

Hi all,
 
I haven´t found any hint about my problem so I would like to ask about 
logdrop rule.
 
I had iptables 1.3.6 from Debian Etch distro and I use logdrop rule like 
these rules:
 
ipt="/sbin/iptables"
 
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ipt_MASQUERADE
modprobe ipt_state
 
$ipt -P INPUT ACCEPT
$ipt -P OUTPUT ACCEPT
$ipt -P FORWARD ACCEPT
$ipt -P logdrop ACCEPT
 
$ipt -F INPUT
$ipt -F OUTPUT
$ipt -F -t nat
$ipt -F -t mangle
$ipt -F logdrop
 
$ipt -X logdrop
$ipt -N logdrop
$ipt -A logdrop -j LOG --log-prefix "logdrop"
$ipt -A logdrop -j DROP
...
$ipt -t mangle -A POSTROUTING -p tcp --dport 25 -j logdrop ... for example
 
It worked fain until I had to compile new iptables version 1.4.0 and my 
problem has appeared every time when I start my firewall script.
 
The error message is here:
 
iptables: Bad built-in chain name
iptables v1.4.0: Couldn't load target 
`logdrop':/usr/local/lib/iptables/libipt_logdrop.so: cannot open shared 
object file: No such file or directory
 
Try `iptables -h' or 'iptables --help' for more information.
I do not know why during the compilation of new iptables, there is not 
libipt_logdrop.so module while in version 1.3.6 there had to be in 
directory, because no errors ever appeared.
 
In changelog from 1.3.6 to 1.4.0, there is no information about 
cancelling logdrop support.
 
So where is the problem ?
What do I do in wrong way ?
 
Thank you.
 
Dan
 
P.S.: I am not subscribed in mailling list, mail me directly please.

Re: logdrop rule does not work any more

[Gáspár Lajos]

Daniel Dvoøák írta:
> $ipt -P logdrop ACCEPT
Policy is not supported on non built-in chains...
>
> $ipt -F INPUT
> $ipt -F OUTPUT
See below..
> $ipt -F -t nat
> $ipt -F -t mangle
Okay...
> $ipt -F logdrop
>
Use this:
$ipt -F -t filter
$ipt -F -t raw

> $ipt -X logdrop
not needed...
> $ipt -N logdrop
> $ipt -A logdrop -j LOG --log-prefix "logdrop"
> $ipt -A logdrop -j DROP
> ...
> $ipt -t mangle -A POSTROUTING -p tcp --dport 25 -j logdrop ... for 
> example
It is not a good idea to drop packets in other than the filter table...
But if you want to do that then declare the logdrop chain in the mangle 
table !!!

$ipt -t mangle -N logdrop
$ipt -t mangle -A logdrop .....


Swifty