LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)
-   -   Can't APPLY Iptables rules (https://www.linuxquestions.org/questions/linux-networking-3/cant-apply-iptables-rules-882072/)

lordbux 05-22-2011 05:42 AM

Can't APPLY Iptables rules
 
I added a few rules to my
/etc/iptables.rules file and then used

sudo iptables-restore < /etc/iptables.rules

but i got an error saying "iptables-restore: line 29 failed"

But the only word on that line is: COMMIT

Posting the file content below

# Generated by iptables-save v1.4.4 on Sun May 22 00:52:05 2011
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Sun May 22 00:52:05 2011
# Generated by iptables-save v1.4.4 on Sun May 22 00:52:05 2011
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed on Sun May 22 00:52:05 2011
# Generated by iptables-save v1.4.4 on Sun May 22 00:52:05 2011
*filter
:FORWARD ACCEPT [0:0]
:INPUT DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p tcp -m tcp -m owner --sport 80 --uid-owner squid -j ACCEPT
-A OUTPUT -p tcp -m tcp -m owner --sport 3128 --uid-owner squid -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -j REDIRECT --to-ports 8080
-A OUTPUT -p tcp -m tcp --sport 3128 -j REDIRECT --to-ports 8080
COMMIT
# Completed on Sun May 22 00:52:05 2011

vkvs 05-22-2011 07:25 AM

Here is your problem:
-A OUTPUT -p tcp -m tcp --sport 80 -j REDIRECT --to-ports 8080
-A OUTPUT -p tcp -m tcp --sport 3128 -j REDIRECT --to-ports 8080

Edit: Check out http://www.ghacks.net/2010/06/14/int...n-to-iptables/
Now each chain can handle the packet traffic in one of four different ways (actions):

ACCEPT: Allow the packet in/out.
REJECT: The target device will reject the packet.
DROP: The packet is immediately dropped and the target device never sees said packet.
RETURN: Go to another chain in your table as if it never saw the rejecting chain.


All times are GMT -5. The time now is 05:12 PM.