Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to block all connections to my pop3, imap server excepting my ip address and log dropped connections to a logfile


-N accept-n-log
-A accept-n-log -j LOG --log-level 4 --log-prefix "accept-n-log:"
-A accept-n-log -j ACCEPT
-N drop-n-log
-A drop-n-log -j LOG --log-level 4 --log-prefix "drop-n-log:"
-A drop-n-log -j DROP

-A INPUT -p tcp -m multiport --dports 110,143 -s m.y.i.p -j ACCEPT
-A INPUT -p tcp -m multiport --dports 110,143 -j DROP

After restarting iptables there is error coming up on line

[root@lax sysconfig]# iptables -N accept-n-log
[root@lax sysconfig]# iptables -A accept-n-log -j LOG --log-level 4 --log-prefix "accept-n-log:"
iptables: No chain/target/match by that name.

But I cannot find any reasons for this error.

My question is: Where is error in this line? Thanks!

share|improve this question

Using -N is not how a new chain is defined inside /etc/sysconfig/iptables. Try replacing -N accept-n-log with the following line, near the top:

:accept-n-log - [0:0]

And doing something similar for drop-n-log. Incidentally, and I'm sure you're aware of this, don't forget that packets won't get to your new chains automagically, and at some point you'll have to have one or more rules in your regular chain(s) that terminate -j accept-n-log or -j drop-n-log.

share|improve this answer
:drop-n-log - [0:0], -A INPUT -p tcp -m multiport --dports 110,143 -j drop-n-log great! there is no error but /var/log/message has just one line lax kernel: [12526982.638296] ip_tables: (C) 2000-2006 Netfilter Core Team after it there no new log events adding.. any ideas? – Ken Tang Nov 23 '12 at 9:04
1) You define a chain using -N i.e. iptables -N chain-name 2) You define chain's policy 3) The rule should jump/[-j] to the chain you just defined e.g -j chain-name – val0x00ff Nov 23 '12 at 9:23
1) You're right, from the command line. But in /etc/sysconfig/iptables, the syntax is different, and that's what the OP says he's doing at the top of the post. 2) No, only built-in chains can have policies, and neither user-defined nor built-in chains can be policy targets (man iptables). 3) See above. – MadHatter Nov 23 '12 at 9:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.