IPTABLES problem with -m multiport

mago · 10-23-2005, 11:44 AM

This might be something really simple but I've been fighting it for 2 days and is starting to drive me crazy.

I'm writing a firewall script and it's over 300 lines already. I want to use the the multiport as follows to save some space and to make the script a bit more manageble but I keep geting an error:

Code:

$IP -A INPUT -p tcp -d x1.x1.x1.x1 -s x2.x2.x2.x2 -m multiport --destination-port 9090:9099 -j ACCEPT

I went through a lot of the documentation in www.netfilter.org and the syntax seems to be right.

Any ideas?

Thanks a bunch in advanced.

Brian1 · 10-23-2005, 12:31 PM

The one module called multiport does not handle the span of ports like you are trying to do from what I know. You want to use the mport module. The multiport can only hande it as a single so one would have to use it like this.

Code:

$IP -A INPUT -p tcp -d x1.x1.x1.x1 -s x2.x2.x2.x2 -m multiport --destination-port 9090,9091,9092,9093,9094,9095,9096,9097,9098,9099 -j ACCEPT

Using mport you can do it this way.

Code:

$IP -A INPUT -p tcp -d x1.x1.x1.x1 -s x2.x2.x2.x2 -m mport --destination-port 9090:9099 -j ACCEPT

And if wish to go farther you can do it as this for addtional ports.

Code:

$IP -A INPUT -p tcp -d x1.x1.x1.x1 -s x2.x2.x2.x2 -m mport --destination-port 22,6000:6003,8529,9090:9099 -j ACCEPT

Hope this helps.
Brian1

mago · 10-23-2005, 02:47 PM

Thanks a lot for the quick answer, my fault I assume that -m multiport and -mport where pretty much the same.

imitheos · 10-24-2005, 05:03 PM

Quote:

Originally posted by Brian1
The one module called multiport does not handle the span of ports like you are trying to do from what I know. You want to use the mport module. The multiport can only hande it as a single so one would have to use it like this.

Code:

$IP -A INPUT -p tcp -d x1.x1.x1.x1 -s x2.x2.x2.x2 -m multiport --destination-port 9090,9091,9092,9093,9094,9095,9096,9097,9098,9099 -j ACCEPT

Using mport you can do it this way.

Code:

$IP -A INPUT -p tcp -d x1.x1.x1.x1 -s x2.x2.x2.x2 -m mport --destination-port 9090:9099 -j ACCEPT

And if wish to go farther you can do it as this for addtional ports.

Code:

$IP -A INPUT -p tcp -d x1.x1.x1.x1 -s x2.x2.x2.x2 -m mport --destination-port 22,6000:6003,8529,9090:9099 -j ACCEPT

Hope this helps.
Brian1

I may be wrong by my iptables manpage mentions the exact opposite

Code:

   mport
       This  module  matches  a  set of source or destination ports.  Up to 15
       ports can be specified.  It can only be used in conjunction with -p tcp
       or -p udp.

       --destination-ports port[,port[,port...]]
              Match if the destination port is one of the  given  ports.   The
              flag --dports is a convenient alias for this option.

   multiport
       This module matches a set of source or destination  ports.   Up  to  15
       ports  can be specified.  A port range (port:port) counts as two ports.
       It can only be used in conjunction with -p tcp or -p udp.

       --destination-ports [!] port[,port[,port:port...]]
              Match  if  the  destination port is one of the given ports.  The
              flag --dports is a convenient alias for this option.

Also, for a simple span of ports you don't need extensions
You can do the following:

Code:

$IP -A INPUT -p tcp -d x1.x1.x1.x1 -s x2.x2.x2.x2 --dport 9090:9099 -j ACCEPT

mago · 10-26-2005, 10:10 PM

Ok I guess I went totally dumb but I just cant make it work

Here is an example of what I'm trying to do:

Code:

$IP -A INPUT -p tcp -m mport -s $WWW -d $POKER2  --dports 7327,9090:9099 -j ACCEPT

When I run it I just get this:

Quote:

Couldn't load match `mport':/usr/lib/iptables/libipt_mport.so: cannot open shared object file: No such file or directory

I'm running iptables 1.3.1 so I don't belive I need to patch-o-matic my install do I?

imitheos · 10-27-2005, 08:14 AM

Quote:

Originally posted by mago
Ok I guess I went totally dumb but I just cant make it work

Here is an example of what I'm trying to do:

Code:

$IP -A INPUT -p tcp -m mport -s $WWW -d $POKER2 --dports 7327,9090:9099 -j ACCEPT

When I run it I just get this:

I'm running iptables 1.3.1 so I don't belive I need to patch-o-matic my install do I?

This means that you don't have the module for iptables since it can't load the .so library.
If you run "man iptables" you will see that you need the "multiport" and NOT the "mport" module (at least according to my
manpage)

( Also mport is deprecated according to http://netfilter.org/projects/patch-...obsolete-mport )

so try

Code:

$IP -A INPUT -p tcp -m multiport -s $WWW -d $POKER2  --dports 7327,9090:9099 -j ACCEPT

if not then try

Code:

$IP -A INPUT -p tcp -m multiport -s $WWW -d $POKER2  --dport 7327 -j ACCEPT
$IP -A INPUT -p tcp -m multiport -s $WWW -d $POKER2  --dport 9090:9099 -j ACCEPT