Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I built and installed iptables on my linux embedded system. If I list all rules, everything works fine:

#iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

But, if I add a new rule to block icmp ping, I'll get the follwing error:

iptables -A INPUT -i eth0 -p icmp --icmp-type any -s 0/0 -d 10.20.3.179 -m state --state NEW,ESTABLISHED,RELATED -j DROP
iptables: No chain/target/match by that name.

How to fix it?

Note: I'm launching command as super user

share|improve this question
    
That is a cut-and-paste from a terminal session above, not you retyping the data, yes? I only ask because sometimes people retype things and ignore important details, see eg serverfault.com/questions/513806/… –  MadHatter Jul 16 '13 at 15:05
1  
First I would issue su - so you get a root shell. Secondly you can run the command as follow. Note -m state --state is not longer recommended by #Netfilter. I would use iptables -A INPUT -i eth0 -p icmp --icmp-type any -s 0/0 -d 10.20.3.179 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j DROP –  val0x00ff Jul 16 '13 at 15:13
    
I think you could use # iptables -A INPUT -i eth0 -p icmp -j DROP –  ALex_hha Jul 16 '13 at 18:51
    
The command provided by @ALex_hha works fine, but it blocks all icmp requests in both directions, I mean: neither I can't ping nor I can't be pinged. Can I improve it? –  aldo85ita Jul 17 '13 at 7:18
    
@val0x00ff, your command is not accepted, it returns again: “iptables: No chain/target/match by that name”. I think the issue is related to "--icmp-typ", "-s", "-d", "-m" and "--ctstate" options, because without them, the command works. Why you're options are not accepted? Have I add some config in kernel menuconfig? What do you think? –  aldo85ita Jul 17 '13 at 7:23

1 Answer 1

up vote 2 down vote accepted

You need to figure out which part of the rule is causing that error message. It's probably the -m state part, but not necessarily. The various extensions to iptables and netfilter have to be compiled into the iptables userspace binary and into netfilter in the Linux kernel. You can determine which part you are missing by asking iptables for the help information on the extension you are testing. Here are some ways to test for the various extensions:

$ iptables -m state -h
$ iptables -p icmp -h
$ iptables -j DROP -h

If you get help output that includes information about the extension at the very bottom of the output, then it is compiled into the userspace binary. If not, then you need to recompile iptables. If that works, try the simplest possible rule to see if the extension is included in the kernel space:

$ iptables -A INPUT -m state --state NEW
$ iptables -A INPUT -p icmp
$ iptables -A INPUT -j DROP

(Careful with those rules, the last one you'll want to remove because it will probably DROP more than you want to!) When you get the error message again: No chain/target/match by that name you'll know that particular extension is not compiled into your kernel. You'll need to recompile your kernel.

Look through the make files in linux/net/ipv6/netfilter, linux/net/ipv4/netfilter, and linux/net/netfilter for options on enabling various extensions for the kernel. For the userspace, I think the make files in question are in iptables/extensions but I think the folder structure has changed a little in more recent versions.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.