iptables error

l0rddarkf0rce · 05-06-2007, 12:20 PM

Running iptables v1.3.5 on Slack 11 kernel 2.6.21.1. The following entry in my rc.firewall file

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

is generating the error

iptables: Unknown error 4294967295

Any ideas on how to fix this error?

simcox1 · 05-06-2007, 01:24 PM

Do you need to specify which port and which interface it's on?

eg

iptables -A INPUT -p ALL -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

l0rddarkf0rce · 05-06-2007, 07:44 PM

I shouldn't have to do that. I just tried it for fun and still got the same error. This is one of the lines that I have in my rc.firewall script. This line was working just fine until I upgraded the kernel.

jeenam · 05-07-2007, 09:42 AM

The problem is the combination of the newer kernel and the ancient version of iptables running on the system. Slack 11 (obviously) comes with v1.3.5 of the iptables userspace software. Use v1.3.6 or greater. From the netfilter.org site:

http://www.netfilter.org/projects/ip...bles-1.3.6.txt

- Fix "Unknown error 4294967295" message
[ Bugzilla #460, Patrick McHardy ]

iptables v1.3.7 was released December of 2006 but it may not compile properly for you. If that is the case, get one of the latest snapshot releases: ftp://ftp.netfilter.org/pub/iptables/snapshot/

l0rddarkf0rce · 05-07-2007, 03:29 PM

I'll download and recompile tonight and see if that helps. Thanks for the assistance.

l0rddarkf0rce · 05-07-2007, 04:01 PM

OK downloaded, compiled, and installed 3.7. Now when I enter the same command

Code:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

I get

iptables: No chain/target/match by that name

After RTFM pages I saw that there are 2 new options that aparently extend what I have above they are conntrack and --ctstate I tried those and I get the same error message. So now my line looks like

Code:

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Any ideas?

rworkman · 05-07-2007, 04:48 PM

You're missing support for some iptables stuff in your kernel config. Enable everything iptables related as modules [1][2] and it will work.

[1] No, it's not a security risk. If it's not being used, the module won't be loaded.
[2] No, it's not strictly necessary to have *everything* enabled, but if you knew what was and wasn't needed, you wouldn't be here, would you?

jeenam · 05-08-2007, 10:09 AM

rworkman is correct. More specifically, conntrack and State matching must be enabled in your kernel config before recompiling.

l0rddarkf0rce · 05-10-2007, 10:12 PM

thanks everyone! that's what i love about this site. you have questions, you get answers.