0

I am getting the following error when configuring iptables on a Debian 7.6 server to log new TCP connections:

Bad argument `NEW'

Error occurred at line: ##

The line throwing the error is formatted as such:

-A INBOUND-ACCEPT -p tcp -m state --state NEW -j LOG --log-prefix ' NEW INBOUND TCP ' --log-level 4

I am using the 'iptables-restore' command to apply firewall rules from a file. What is the problem with my configuration here? Any assistance is greatly appreciated.

NOTE INBOUND-ACCEPT is a chain I created to facilitate logging for accepted packets. There are a few other similarly formatted lines in the chain for UDP and ICMP logging, but fixing the issue for this rule will allow me to fix the problem for the other lines in my rules file.

1
  • This wouldn't be on an OpenVZ container, by any chance, would it?
    – MadHatter
    Mar 12, 2015 at 15:59

3 Answers 3

1

Try switching to double quotes instead of single after --log-prefix

0
0

I found out that using '-m state' and '--state STATE' is deprecated. I wasn't able to resolve this using those parameters, but by using '-m conntrack' and '--ctstate STATE' in lieu of the former parameters resolved the issue. Below is my final command that fixed this:

-A INBOUND-ACCEPT -p tcp -m conntrack --ctstate NEW -j LOG --log-prefix " NEW INBOUND TCP " --log-level 4

EDIT One of my team members helped me find a solution, I didn't notice but not only did he replace the '-m state' and '--state STATE' with the conntrack equivalents, he also changed the single quoted to double quotes.

0

Tried the command on a RHEL test machine. It worked fine.

When I ran iptables-save, the command saved it with double quotes:

# Generated by iptables-save v1.3.5 on Thu Mar 12 13:12:45 2015
*filter
:INPUT ACCEPT [399357208:150111383153]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [311789762:341416567394]
-A INBOUND-ACCEPT -p tcp -m state --state NEW -j LOG --log-prefix " NEW INBOOUND TCP "
COMMIT
# Completed on Thu Mar 12 13:12:45 2015

You may want to use double quotes instead.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .