0

I am trying to block all connections to my pop3, imap server excepting my ip address and log dropped connections to a logfile

/etc/sysconfig/iptables

...
-N accept-n-log
-A accept-n-log -j LOG --log-level 4 --log-prefix "accept-n-log:"
-A accept-n-log -j ACCEPT
-N drop-n-log
-A drop-n-log -j LOG --log-level 4 --log-prefix "drop-n-log:"
-A drop-n-log -j DROP

-A INPUT -p tcp -m multiport --dports 110,143 -s m.y.i.p -j ACCEPT
-A INPUT -p tcp -m multiport --dports 110,143 -j DROP
...

After restarting iptables there is error coming up on line

[root@lax sysconfig]# iptables -N accept-n-log
[root@lax sysconfig]# iptables -A accept-n-log -j LOG --log-level 4 --log-prefix "accept-n-log:"
iptables: No chain/target/match by that name.

But I cannot find any reasons for this error.

My question is: Where is error in this line? Thanks!

Improve this question

1 Answer 1

Reset to default
0

Using -N is not how a new chain is defined inside /etc/sysconfig/iptables. Try replacing -N accept-n-log with the following line, near the top:

:accept-n-log - [0:0]

And doing something similar for drop-n-log. Incidentally, and I'm sure you're aware of this, don't forget that packets won't get to your new chains automagically, and at some point you'll have to have one or more rules in your regular chain(s) that terminate -j accept-n-log or -j drop-n-log.

Improve this answer
3
  • :drop-n-log - [0:0], -A INPUT -p tcp -m multiport --dports 110,143 -j drop-n-log great! there is no error but /var/log/message has just one line lax kernel: [12526982.638296] ip_tables: (C) 2000-2006 Netfilter Core Team after it there no new log events adding.. any ideas?
    – Ken Tang
    Nov 23, 2012 at 9:04
  • 1) You define a chain using -N i.e. iptables -N chain-name 2) You define chain's policy 3) The rule should jump/[-j] to the chain you just defined e.g -j chain-name
    – Valentin Bajrami
    Nov 23, 2012 at 9:23
  • 1) You're right, from the command line. But in /etc/sysconfig/iptables, the syntax is different, and that's what the OP says he's doing at the top of the post. 2) No, only built-in chains can have policies, and neither user-defined nor built-in chains can be policy targets (man iptables). 3) See above.
    – MadHatter
    Nov 23, 2012 at 9:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .