LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices



Reply
 
Search this Thread
Old 01-26-2004, 03:02 AM   #1
z00t
LQ Newbie
 
Registered: Apr 2003
Posts: 3

Rep: Reputation: 0
Iptables - Couldn't load target `ACCPET':/lib/iptables/libipt_ACCPET.so:


I have got a problem with my iptables. Setting this firewall up is a part of a school project. Problem is everything worked when i left the machine last week, now when i try to start iptables i get this message:

iptables: Chain already exists
iptables v1.2.6a: Couldn't load target `ACCPET':/lib/iptables/libipt_ACCPET.so:
cannot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.


As far as i know, noone have had access to the machine through the weekend as the school have been closed, so i got no idea what happend or what to do to fix this, my iptables script looks like this:

#!/bin/sh

#Ip Adresses
DMZIP=172.17.2.1
INTIP=172.17.1.1
EXTIP=217.60.180.25

#Tillad Forwaring af Pakker
echo "1" > /proc/sys/net/ipv4/ip_forward

#Lukker alt INPUT og FORWARD
iptables -P INPUT DROP
iptables -P FORWARD DROP

#Tillader OUTPUT traffik
iptables -P OUTPUT ACCEPT
#Sletter gammel konfiguration
iptables -F
iptables -t nat -F

#Laver en ny kæde
iptables -N block
#Tillader alt lokal traffik
iptables -A INPUT -i lo -j ACCEPT

#Router pakker fra 172.17.1.0 til 217.60.180.25
iptables -t nat -A POSTROUTING -s 172.17.1.0/24 -d "!" 172.17.1.0/24 -j SNAT --to $EXTIP

#Router pakker fra 172.17.2.0 til 217.60.180.25
iptables -t nat -A POSTROUTING -s 172.17.2.0/24 -d "!" 172.17.2.0/24 -j SNAT --to $EXTIP

#Router pakker fra 172.17.1.0 til 172.17.2.0
iptables -t nat -A PREROUTING -d 172.17.1.0/24 -j DNAT --to $INTIP

#Router pakker fra 172.17.2.0 til 172.17.1.0
iptables -t nat -A PREROUTING -d 172.17.2.0/24 -j DNAT --to $DMZIP

#Tillader forbindelser der er oprettet
iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT

#Tillader nye forbindelser der kommer fra internt netværk (eth1 og eth2)
iptables -A block -m state --state NEW -i eth1 -j ACCEPT
iptables -A block -m state --state NEW -i eth2 -j ACCEPT

#Kobler block kæden på INPUT OG FORWARD
iptables -A INPUT -j block
iptables -A FORWARD -j block

#bner for port 21,22,25,80 og 110 på eth0
iptables -A INPUT -p tcp --dport 22 -i eth0 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -i eth0 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -i eth0 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -i eth0 -j ACCEPT
iptables -A INPUT -p tcp --dport 110 -i eth0 -j ACCEPT

#Tillader Forwarding af port 21,25,80 og 110
iptables -A FORWARD -p tcp --dport 21 -i eth0 -j ACCEPT
iptables -A FORWARD -p tcp --dport 25 -i eth0 -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -i eth0 -j ACCPET
iptables -A FORWARD -p tcp --dport 110 -i eth0 -j ACCEPT

#Forwarder alle pakker der kommer på port 21,25,80 og 110 til den respektive server
iptables -t nat -A PREROUTING -p tcp --dport 21 -d 217.60.180.25 -j DNAT --to 172.17.1.10
iptables -t nat -A PREROUTING -p tcp --dport 25 -d 217.60.180.25 -j DNAT --to 172.17.1.10
iptables -t nat -A PREROUTING -p tcp --dport 80 -d 217.60.180.25 -j DNAT --to 172.17.1.10
iptables -t nat -A PREROUTING -p tcp --dport 110 -d 217.60.180.25 -j DNAT --to 172.17.1.10

And im running Red Hat 8.0 if thats any relevant information
 
Old 01-26-2004, 03:14 AM   #2
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
Re: Iptables - Couldn't load target `ACCPET':/lib/iptables/libipt_ACCPET.so:


iptables: Chain already exists

Might need to add flush rules at the beginning in case you already have some rules defined when you run the script.

iptables v1.2.6a: Couldn't load target `ACCPET':/lib/iptables/libipt_ACCPET.so:
There's your hint, look how ACCEPT is spelled in the above error message (or miss-spelled in this case)

Code:
#Ip Adresses
DMZIP=172.17.2.1
INTIP=172.17.1.1
EXTIP=217.60.180.25

#Tillad Forwaring af Pakker
echo "1" > /proc/sys/net/ipv4/ip_forward

#Lukker alt INPUT og FORWARD
iptables -P INPUT DROP
iptables -P FORWARD DROP

#Tillader OUTPUT traffik
iptables -P OUTPUT ACCEPT
#Sletter gammel konfiguration
iptables -F
iptables -t nat -F

#Laver en ny kæde
iptables -N block
#Tillader alt lokal traffik
iptables -A INPUT -i lo -j ACCEPT

#Router pakker fra 172.17.1.0 til 217.60.180.25
iptables -t nat -A POSTROUTING -s 172.17.1.0/24 -d "!" 172.17.1.0/24 -j SNAT --to $EXTIP

#Router pakker fra 172.17.2.0 til 217.60.180.25
iptables -t nat -A POSTROUTING -s 172.17.2.0/24 -d "!" 172.17.2.0/24 -j SNAT --to $EXTIP

#Router pakker fra 172.17.1.0 til 172.17.2.0
iptables -t nat -A PREROUTING -d 172.17.1.0/24 -j DNAT --to $INTIP

#Router pakker fra 172.17.2.0 til 172.17.1.0
iptables -t nat -A PREROUTING -d 172.17.2.0/24 -j DNAT --to $DMZIP

#Tillader forbindelser der er oprettet
iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT

#Tillader nye forbindelser der kommer fra internt netværk (eth1 og eth2)
iptables -A block -m state --state NEW -i eth1 -j ACCEPT
iptables -A block -m state --state NEW -i eth2 -j ACCEPT

#Kobler block kæden på INPUT OG FORWARD
iptables -A INPUT -j block
iptables -A FORWARD -j block

#bner for port 21,22,25,80 og 110 på eth0
iptables -A INPUT -p tcp --dport 22 -i eth0 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -i eth0 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -i eth0 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -i eth0 -j ACCEPT
iptables -A INPUT -p tcp --dport 110 -i eth0 -j ACCEPT

#Tillader Forwarding af port 21,25,80 og 110
iptables -A FORWARD -p tcp --dport 21 -i eth0 -j ACCEPT
iptables -A FORWARD -p tcp --dport 25 -i eth0 -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -i eth0 -j ACCPET   <-----------------------------
iptables -A FORWARD -p tcp --dport 110 -i eth0 -j ACCEPT
Hope that helps.
 
Old 01-26-2004, 03:22 AM   #3
z00t
LQ Newbie
 
Registered: Apr 2003
Posts: 3

Original Poster
Rep: Reputation: 0
Re: Re: Iptables - Couldn't load target `ACCPET':/lib/iptables/libipt_ACCPET.so:

Quote:
Originally posted by Capt_Caveman

iptables: Chain already exists

Might need to add flush rules at the beginning in case you already have some rules defined when you run the script.

iptables v1.2.6a: Couldn't load target `ACCPET':/lib/iptables/libipt_ACCPET.so:
There's your hint, look how ACCEPT is spelled in the above error message (or miss-spelled in this case)


Hope that helps.
Thanks alot, didnt even notice that, works fine again now..
 
Old 01-26-2004, 03:24 AM   #4
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
It's always the little things that get you with iptables
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables: No chain/target/match by that name schatoor Linux - Networking 6 01-04-2009 10:10 PM
MASQUERADE Target not found (IPTABLES) bksmart Linux - Networking 15 07-27-2005 09:57 PM
pls help!!! iptables patch for IMQ device target debloxie Linux - Networking 0 03-03-2004 06:16 AM
Debian 3.0/r1 iptables LOG target not working markus1982 Linux - Distributions 5 05-25-2003 06:01 PM
iptables -m owner target problem cirrusgr Linux - Networking 1 04-02-2003 01:53 AM


All times are GMT -5. The time now is 04:37 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration