Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to block all connections to my pop3, imap server excepting my ip address and log dropped connections to a logfile

/etc/sysconfig/iptables

...
-N accept-n-log
-A accept-n-log -j LOG --log-level 4 --log-prefix "accept-n-log:"
-A accept-n-log -j ACCEPT
-N drop-n-log
-A drop-n-log -j LOG --log-level 4 --log-prefix "drop-n-log:"
-A drop-n-log -j DROP

-A INPUT -p tcp -m multiport --dports 110,143 -s m.y.i.p -j ACCEPT
-A INPUT -p tcp -m multiport --dports 110,143 -j DROP
...

After restarting iptables there is error coming up on line

[root@lax sysconfig]# iptables -N accept-n-log
[root@lax sysconfig]# iptables -A accept-n-log -j LOG --log-level 4 --log-prefix "accept-n-log:"
iptables: No chain/target/match by that name.

But I cannot find any reasons for this error.

My question is: Where is error in this line? Thanks!

share|improve this question
add comment

1 Answer

Using -N is not how a new chain is defined inside /etc/sysconfig/iptables. Try replacing -N accept-n-log with the following line, near the top:

:accept-n-log - [0:0]

And doing something similar for drop-n-log. Incidentally, and I'm sure you're aware of this, don't forget that packets won't get to your new chains automagically, and at some point you'll have to have one or more rules in your regular chain(s) that terminate -j accept-n-log or -j drop-n-log.

share|improve this answer
    
:drop-n-log - [0:0], -A INPUT -p tcp -m multiport --dports 110,143 -j drop-n-log great! there is no error but /var/log/message has just one line lax kernel: [12526982.638296] ip_tables: (C) 2000-2006 Netfilter Core Team after it there no new log events adding.. any ideas? –  Ken Tang Nov 23 '12 at 9:04
    
1) You define a chain using -N i.e. iptables -N chain-name 2) You define chain's policy 3) The rule should jump/[-j] to the chain you just defined e.g -j chain-name –  val0x00ff Nov 23 '12 at 9:23
    
1) You're right, from the command line. But in /etc/sysconfig/iptables, the syntax is different, and that's what the OP says he's doing at the top of the post. 2) No, only built-in chains can have policies, and neither user-defined nor built-in chains can be policy targets (man iptables). 3) See above. –  MadHatter Nov 23 '12 at 9:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.