I built and installed iptables on my linux embedded system. If I list all rules, everything works fine:

#iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

But, if I add a new rule to block icmp ping, I'll get the follwing error:

iptables -A INPUT -i eth0 -p icmp --icmp-type any -s 0/0 -d -m state --state NEW,ESTABLISHED,RELATED -j DROP
iptables: No chain/target/match by that name.

How to fix it?

Note: I'm launching command as super user

  • That is a cut-and-paste from a terminal session above, not you retyping the data, yes? I only ask because sometimes people retype things and ignore important details, see eg serverfault.com/questions/513806/… – MadHatter Jul 16 '13 at 15:05
  • 1
    First I would issue su - so you get a root shell. Secondly you can run the command as follow. Note -m state --state is not longer recommended by #Netfilter. I would use iptables -A INPUT -i eth0 -p icmp --icmp-type any -s 0/0 -d -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j DROP – Valentin Bajrami Jul 16 '13 at 15:13
  • I think you could use # iptables -A INPUT -i eth0 -p icmp -j DROP – ALex_hha Jul 16 '13 at 18:51
  • The command provided by @ALex_hha works fine, but it blocks all icmp requests in both directions, I mean: neither I can't ping nor I can't be pinged. Can I improve it? – aldo85ita Jul 17 '13 at 7:18
  • @val0x00ff, your command is not accepted, it returns again: “iptables: No chain/target/match by that name”. I think the issue is related to "--icmp-typ", "-s", "-d", "-m" and "--ctstate" options, because without them, the command works. Why you're options are not accepted? Have I add some config in kernel menuconfig? What do you think? – aldo85ita Jul 17 '13 at 7:23

You need to figure out which part of the rule is causing that error message. It's probably the -m state part, but not necessarily. The various extensions to iptables and netfilter have to be compiled into the iptables userspace binary and into netfilter in the Linux kernel. You can determine which part you are missing by asking iptables for the help information on the extension you are testing. Here are some ways to test for the various extensions:

$ iptables -m state -h
$ iptables -p icmp -h
$ iptables -j DROP -h

If you get help output that includes information about the extension at the very bottom of the output, then it is compiled into the userspace binary. If not, then you need to recompile iptables. If that works, try the simplest possible rule to see if the extension is included in the kernel space:

$ iptables -A INPUT -m state --state NEW
$ iptables -A INPUT -p icmp
$ iptables -A INPUT -j DROP

(Careful with those rules, the last one you'll want to remove because it will probably DROP more than you want to!) When you get the error message again: No chain/target/match by that name you'll know that particular extension is not compiled into your kernel. You'll need to recompile your kernel.

Look through the make files in linux/net/ipv6/netfilter, linux/net/ipv4/netfilter, and linux/net/netfilter for options on enabling various extensions for the kernel. For the userspace, I think the make files in question are in iptables/extensions but I think the folder structure has changed a little in more recent versions.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.