1

I'm trying to set iptables on Debian 6 Squeeze amd64 and I'm faced to this error message

root@Vision:~/bin# iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables: No chain/target/match by that name.

I searched on the web but I didn't find a solution. Other rules gives me same error.

2
  • can you post the output of the iptables-save command?
    – Zypher
    Mar 14, 2011 at 1:27
  • ... also post the output of find /lib -name "*conntrack.ko" please.
    – pepoluan
    Mar 14, 2011 at 4:52

3 Answers 3

2

your kernel needs the netfilter module conntrack

Location:                                                                                                                                          │  
  │     -> Networking support (NET [=y])                                                                                                                 │  
  │       -> Networking options                                                                                                                          │  
  │         -> Network packet filtering framework (Netfilter) (NETFILTER [=y])                                                                           │  
  │           -> Core Netfilter Configuration                                                                                                            │  
  │             -> Netfilter Xtables support (required for ip_tables) (NETFILTER_XTABLES [=m]) 
2

check the dmesg output for the actual error also run the rule with strace to get the missing modules

1

It looks like your kernel is missing some Netfilter features. You need the Xtables support, as Fabio pointed out. However, you need the xt_conntrack feature as well. It might be compiled as a module, so that entering the command you wrote should load it. But in some cases, you'll need to load it by yourself so, before going further, try

# modprobe xt_conntrack

If it doesn't work, you'll have to recompile your kernel to enable it. You can find the option here:

Symbol: NETFILTER_XT_MATCH_CONNTRACK                                                                                                                                                     
│   Depends on: NET [=y] && INET [=y] && NETFILTER [=y] && NETFILTER_XTABLES [=y] &&      NF_CONNTRACK [=y]                                                                                               
│   Location:                                                                                                                                                                                   
│     -> Networking support (NET [=y])                                                                                                                                                            
│       -> Networking options                                                                                                                                                                   
│         -> Network packet filtering framework (Netfilter) (NETFILTER [=y])                                                                                                                       
│           -> Core Netfilter Configuration                                                                                                                                                      
│             -> Netfilter Xtables support (required for ip_tables) (NETFILTER_XTABLES [=y])

If you're not familiar with kernel building, you might want to have a look at the book at http://www.kroah.com/lkn/ which explains all you need to know from the start in a very clear fashion.

(I know this is a bit late to answer. Still, I've faced the same issue today so I thought it might help someone someday.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .