iptables problem: conntrack rev 2 does not support port ranges

iptables problem: conntrack rev 2 does not support port ranges

[Brian Schang]

Hello:

Last night I upgraded from 'iptables 1.4.10' to 'iptables 1.4.12.1'. 
When doing so, I encountered a possible regression: Extended Connection 
Tracking Match Support within shorewall was "Available" with v1.4.10, 
but is "Not available" with v1.4.12.1. Note that I am using 'shorewall 
4.4.23.3' and openSuSE 11.4 with its stock kernal 2.6.37.6-0.7-default.

I dug into this a little bit and discovered:
# iptables -A test -m conntrack -p tcp --ctorigdstport 22 -j ACCEPT
iptables v1.4.12.1: conntrack rev 2 does not support port ranges
Try `iptables -h' or 'iptables --help' for more information.

With some Googling, I discovered that Tom Eastep had encountered the 
same issue. He submitted a patch for iptables and Jan Engelhardt 
ultimately released 'iptables 1.4.12.1'.

For some reason, iptables v1.4.12.1 does not seem to have fixed the 
issue for me. Has anyone else seen this problem? Any suggestions?

Thanks.

-- 
Brian

Re: iptables problem: conntrack rev 2 does not support port ranges

[Jan Engelhardt]

On Monday 2011-09-19 13:20, Brian Schang wrote:

> I dug into this a little bit and discovered:
> # iptables -A test -m conntrack -p tcp --ctorigdstport 22 -j ACCEPT
> iptables v1.4.12.1: conntrack rev 2 does not support port ranges
> Try `iptables -h' or 'iptables --help' for more information.
>
> With some Googling, I discovered that Tom Eastep had encountered the same
> issue. He submitted a patch for iptables and Jan Engelhardt ultimately released
> 'iptables 1.4.12.1'.

(It was not me who released 1.4.12.1.)

Tom Eastep's fix was only merged after that release.

Re: iptables problem: conntrack rev 2 does not support port ranges

[Brian Schang]

Hello:

On 9/19/2011 7:44 AM, Jan Engelhardt wrote:
> On Monday 2011-09-19 13:20, Brian Schang wrote:
>
>> I dug into this a little bit and discovered:
>> # iptables -A test -m conntrack -p tcp --ctorigdstport 22 -j ACCEPT
>> iptables v1.4.12.1: conntrack rev 2 does not support port ranges
>> Try `iptables -h' or 'iptables --help' for more information.
>>
>> With some Googling, I discovered that Tom Eastep had encountered the same
>> issue. He submitted a patch for iptables and Jan Engelhardt ultimately released
>> 'iptables 1.4.12.1'.
>
> (It was not me who released 1.4.12.1.)
>
> Tom Eastep's fix was only merged after that release.

My apologies -- thanks for clarifying. I misinterpreted the git history.