Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set iptables on Debian 6 Squeeze amd64 and I'm faced to this error message

root@Vision:~/bin# iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables: No chain/target/match by that name.

I searched on the web but I didn't find a solution. Other rules gives me same error.

share|improve this question
    
can you post the output of the iptables-save command? –  Zypher Mar 14 '11 at 1:27
    
... also post the output of find /lib -name "*conntrack.ko" please. –  pepoluan Mar 14 '11 at 4:52
add comment

3 Answers 3

check the dmesg output for the actual error also run the rule with strace to get the missing modules

share|improve this answer
add comment

your kernel needs the netfilter module conntrack

Location:                                                                                                                                          │  
  │     -> Networking support (NET [=y])                                                                                                                 │  
  │       -> Networking options                                                                                                                          │  
  │         -> Network packet filtering framework (Netfilter) (NETFILTER [=y])                                                                           │  
  │           -> Core Netfilter Configuration                                                                                                            │  
  │             -> Netfilter Xtables support (required for ip_tables) (NETFILTER_XTABLES [=m]) 
share|improve this answer
add comment

It looks like your kernel is missing some Netfilter features. You need the Xtables support, as Fabio pointed out. However, you need the xt_conntrack feature as well. It might be compiled as a module, so that entering the command you wrote should load it. But in some cases, you'll need to load it by yourself so, before going further, try

# modprobe xt_conntrack

If it doesn't work, you'll have to recompile your kernel to enable it. You can find the option here:

Symbol: NETFILTER_XT_MATCH_CONNTRACK                                                                                                                                                     
│   Depends on: NET [=y] && INET [=y] && NETFILTER [=y] && NETFILTER_XTABLES [=y] &&      NF_CONNTRACK [=y]                                                                                               
│   Location:                                                                                                                                                                                   
│     -> Networking support (NET [=y])                                                                                                                                                            
│       -> Networking options                                                                                                                                                                   
│         -> Network packet filtering framework (Netfilter) (NETFILTER [=y])                                                                                                                       
│           -> Core Netfilter Configuration                                                                                                                                                      
│             -> Netfilter Xtables support (required for ip_tables) (NETFILTER_XTABLES [=y])

If you're not familiar with kernel building, you might want to have a look at the book at http://www.kroah.com/lkn/ which explains all you need to know from the start in a very clear fashion.

(I know this is a bit late to answer. Still, I've faced the same issue today so I thought it might help someone someday.)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.