No chain/target/match by that name

NotionCommotion · 03-01-2017, 11:59 AM

I am sure I am doing a bonehead move, but I can't figure out why I cannot open up port 1337. Any advise? Thanks

Code:

[Michael@vps2 ~]$ sudo iptables --line -vnL
Chain INPUT (policy DROP 86 packets, 10551 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1      277 29554 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22
2        3   121 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80
3        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443
4        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:1443
5        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:10000
6        4   168 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 307 packets, 39827 bytes)
num   pkts bytes target     prot opt in     out     source               destination
[Michael@vps2 ~]$
[Michael@vps2 ~]$ sudo iptables -I INPUT 6 -i eth0 -p tcp --dport 1337 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables: No chain/target/match by that name.
[Michael@vps2 ~]$ sudo iptables -A INPUT -i eth0 -p tcp --dport 1337 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables: No chain/target/match by that name.
[Michael@vps2 ~]$

r3sistance · 03-01-2017, 02:23 PM

does eth0 definitely exist, just to check. "ip addr show" should confirm it, also what distribution are you using?

NotionCommotion · 03-02-2017, 12:48 AM

Quote:

Originally Posted by r3sistance

does eth0 definitely exist, just to check. "ip addr show" should confirm it, also what distribution are you using?

Ah ha, a clue! It is a virtual server hosted by others and operating Centos6. Should I just replace eth0 with venet0? I take it venet0 is just some virtual interface?

Thanks!

Code:

[Michael@vps2 ~]$ ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: venet0: <BROADCAST,POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
    link/void
    inet 127.0.0.1/32 scope host venet0
    inet 12.34.56.78/32 brd 12.34.56.78 scope global venet0:0
[Michael@vps2 ~]$

r3sistance · 03-02-2017, 05:45 AM

Are you using openvz or something? Not familiar with that.

It looks like the public ip is hosted on venet0:0, so it should be venet0 instead of eth0 by looks of things.

GazL · 03-02-2017, 01:40 PM

Unless you're using a really old distro, try replacing -m state --state ... with -m conntrack --ctstate ....

-m state was obsoleted a while back.

r3sistance · 03-02-2017, 02:31 PM

Quote:

Originally Posted by GazL

Unless you're using a really old distro, try replacing -m state --state ... with -m conntrack --ctstate ....

-m state was obsoleted a while back.

Yes, the state module was obsoluted but then the syntax was aliased back to conntrack module and so the old syntax is still perfectly valid.

GazL · 03-02-2017, 02:48 PM

Quote:

Originally Posted by r3sistance

Yes, the state module was obsoluted but then the syntax was aliased back to conntrack module and so the old syntax is still perfectly valid.

Ahh, I wasn't aware of that. I can certainly remember having to go through all my rules and change them at one point, but maybe that was just to stop it whining at me.

r3sistance · 03-02-2017, 03:03 PM

I'd personally still use the ctstate method but yeah both are valid. Quick check found the following (just to check I wasn't making this up or mis-remembering)

Quote:

state

The "state" extension is a subset of the "conntrack" module. "state" allows access to the connection tracking state for this packet.
[!] --state state
Where state is a comma separated list of the connection states to match. Only a subset of the states unterstood by "conntrack" are recognized: INVALID, ESTABLISHED, NEW, RELATED or UNTRACKED. For their description, see the "conntrack" heading in this manpage.

http://ipset.netfilter.org/iptables-extensions.man.html