[SOLVED] 4-Line iptables and It Won't Start

mmem700 · 02-29-2012, 05:20 AM

I have worked for hours now trying to find the bug in this /etc/sysconfig/iptables file.

When I start iptables, I get this error:

Code:

Applying iptables firewall rules: Bad argument `COMMIT'
Error occurred at line: 8
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
                                                           [FAILED]

I'm on CentOS 5.7 64-bit.

Here is the iptables file:

Code:

*filter
:INPUT ACCEPT [83115:14679055]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [32454:6899107]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
COMMIT

Stumped!

My Config file /etc/sysconfig/iptables-config

Code:

# Load additional iptables modules (nat helpers)
#   Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IPTABLES_MODULES="ip_conntrack_netbios_ns ip_conntrack_ftp ip_conntrack"

# Unload modules on restart and stop
#   Value: yes|no,  default: yes
# This option has to be 'yes' to get to a sane state for a firewall
# restart or stop. Only set to 'no' if there are problems unloading netfilter
# modules.
IPTABLES_MODULES_UNLOAD="yes"

# Save current firewall rules on stop.
#   Value: yes|no,  default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
# (e.g. on system shutdown).
IPTABLES_SAVE_ON_STOP="no"

# Save current firewall rules on restart.
#   Value: yes|no,  default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets
# restarted.
IPTABLES_SAVE_ON_RESTART="no"

# Save (and restore) rule and chain counter.
#   Value: yes|no,  default: no
# Save counters for rules and chains to /etc/sysconfig/iptables if
# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or
# SAVE_ON_RESTART is enabled.
IPTABLES_SAVE_COUNTER="no"

# Numeric status output
#   Value: yes|no,  default: yes
# Print IP addresses and port numbers in numeric format in the status output.
IPTABLES_STATUS_NUMERIC="yes"

# Verbose status output
#   Value: yes|no,  default: yes
# Print info about the number of packets and bytes plus the "input-" and
# "outputdevice" in the status output.
IPTABLES_STATUS_VERBOSE="no"

# Status output with numbered lines
#   Value: yes|no,  default: yes
# Print a counter/number for every rule in the status output.
IPTABLES_STATUS_LINENUMBERS="yes"

acid_kewpie · 02-29-2012, 05:28 AM

Nope, got me too. I'd be wondering about whitespace / EOL characters etc.

At the same time though, it's not like there is anything big there, so why not just delete the file and manually build the ruleset? Then run a "service iptables save" and it should create a new file.

mmem700 · 02-29-2012, 05:37 AM

Wow... thanks

I simply deleted the file and retyped it and now it works.

Thanks for the suggestion.

...5 hours later !

mmem700 · 02-29-2012, 05:40 AM

Spoke too soon.

I mistakenly named the new (re-typed) file "iptable". That's why it worked.

When I fixed the file name to iptables, I'm still getting the same error.

I am really stumped on this.

mmem700 · 02-29-2012, 05:53 AM

Ok, When I retyped it, I forget a - on state (-state instead of --state).

Now, it's really working.

Thanks again for the suggestion. A bad hidden character must have been the issue.

mmem700 · 02-29-2012, 06:06 AM

I think I know what happened - for anyone else who runs into this problem.

When I leased this server, "/etc/sysconfig/iptables" did not exist, so I created it using iptables-save.

I built this file up with rules but I noticed that this file was always colorized, but always generated an error when I ran it against iptables.

Finally, when I deleted the file and created it from scratch using vi, it was NOT colorized but it always worked with iptables.

SO - There is definitely something different about file created by iptables-save and the one created with vi.

Moral of the story: Don't create your iptables file using iptables-save. Start from scratch using your favorite editor.