LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
Reload this Page iptables commands problem
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 02-18-2010, 01:22 PM   #1
naaman
Member
 
Registered: Jun 2006
Posts: 84

Rep: Reputation: 16
iptables commands problem

Hello,

I try to make my own firewall with iptables but I get a problem.
I only need a very basic kind of firewall, but I decided to add something
else : I want my firewall to be able to log and block portscans... because I experienced some portscans. So, I found an already-made firewall on the web which allows that. Then I modified my own firewall with the one I found and now but I get a problem I don't understand ...

When I run the firewall I get this error :
Code:
* FireWall Starting ... ...
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
My firewall :

Code:
#!/bin/sh
$IPTABLES -P INPUT DROP
$IPTABLES -F INPUT
$IPTABLES -A INPUT -m state --state established -j ACCEPT
$IPTABLES -A INPUT -i lo -j ACCEPT

$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD

$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT

$IPTABLES -N check-flags
$IPTABLES -F check-flags
$IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -m limit \
      --limit 5/minute -j LOG --log-level alert --log-prefix "NMAP-XMAS:"
$IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -m limit --limit \
      5/minute -j LOG --log-level 1 --log-prefix "XMAS:"
$IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG \
      -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS-PSH:"
$IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -m limit \
      --limit 5/minute -j LOG --log-level 1 --log-prefix "NULL_SCAN:"
$IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -m limit \
      --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/RST:"
$IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit \
      --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/FIN:"
$IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
Could you help me ?

thanks,
 
Old 02-18-2010, 02:30 PM   #2
smoker
Senior Member
 
Registered: Oct 2004
Distribution: Fedora Core 4, 12, 13, 14, 15, 17
Posts: 2,279

Rep: Reputation: 250Reputation: 250Reputation: 250
Does the firewall start or just give errors and not start ?

To be honest, $IPTABLES -F INPUT and $IPTABLES -P FORWARD DROP
aren't legal rules.
And deleting a rule just after you made it is silly.
Any other rules with $IPTABLES -F are just deleting rules and need the name of a chain to be effective.

Read man iptables and get rid of the illegal rules.

http://www.netfilter.org/documentation/

Also, that isn't your whole script. You can't just use $iptables unless you define $iptables somewhere.

Notice how there are 6 lines of errors and 6 lines where you use iptables -P or -F ? That's because they aren't legal targets or names of chains. $IPTABLES -F check-flags is legal because it exists - $IPTABLES -F FORWARD/OUTPUT/INPUT are not legal targets or chain names.
Last edited by smoker; 02-18-2010 at 02:38 PM. Reason: update
 
1 members found this post helpful.
Old 02-18-2010, 04:11 PM   #3
naaman
Member
 
Registered: Jun 2006
Posts: 84

Original Poster
Rep: Reputation: 16
Indeed it isn't the whole script.
Here the whole init script :

Code:
 #!/sbin/runscript
IPTABLES=/sbin/iptables

opts="${opts} showstatus panic"

depend() {
  need net
}

start() {
  ebegin "FireWall Starting ..."
  $IPTABLES -F INPUT
  $IPTABLES -P INPUT DROP
  $IPTABLES -A INPUT -m state --state established -j ACCEPT
  
  #$IPTABLES -A INPUT -i lo -j ACCEPT

  $IPTABLES -F FORWARD	
  $IPTABLES -P FORWARD DROP

  $IPTABLES -F OUTPUT
  $IPTABLES -P OUTPUT ACCEPT

  # Detect porscans and act  
  $IPTABLES -N check-flags
  $IPTABLES -F check-flags
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -m limit --limit 5/minute -j LOG --log-level alert --log-prefix "NMAP-XMAS:"
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP 
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS:"
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -j DROP
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS-PSH:"
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "NULL_SCAN:"
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -j DROP
  $IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/RST:"
  $IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
  $IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/FIN:"
  $IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

  $IPTABLES -A FORWARD -j check-flags
  $IPTABLES -A OUTPUT -j check-flags
  $IPTABLES -A INPUT -j check-flags

  eend $?
}

stop() {
  ebegin "FireWall Stoping ..."
  $IPTABLES -F
  $IPTABLES -t nat -F
  $IPTABLES -X
  $IPTABLES -P FORWARD ACCEPT
  $IPTABLES -P INPUT   ACCEPT
  $IPTABLES -P OUTPUT  ACCEPT
  eend $?
}

showstatus() {
  ebegin "Statut"
  $IPTABLES -L -n -v --line-numbers
  eend $?
}

panic() {
  ebegin "FireWall panic mode launched ..."
  $IPTABLES -F
  $IPTABLES -X
  $IPTABLES -t nat -F
  $IPTABLES -P FORWARD DROP
  $IPTABLES -P INPUT   DROP
  $IPTABLES -P OUTPUT  DROP
  $IPTABLES -A INPUT -i lo -j ACCEPT
  $IPTABLES -A OUTPUT -o lo -j ACCEPT
  eend $?
}

restart() {
  svc_stop; svc_start
}

showoptions() {
  echo "Usage: $0 {start|panic|stop|showstatus}"
  echo "start) 	    Start the FireWall"      
  echo "stop)       Stop the FireWall"
  echo "showstatus) Display FireWall status."
}
I did'nt know I was using illegal iptables rules ....
I'm going to see is I can fix it although it looks weird to me they are illegal iptables commands
Last edited by naaman; 02-18-2010 at 04:35 PM.
 
Old 02-18-2010, 04:34 PM   #4
naaman
Member
 
Registered: Jun 2006
Posts: 84

Original Poster
Rep: Reputation: 16
Are you sure the lines where -F is used are the real problem ?
although they are not legal they work, because when I comment
the "porscan" bunch of commands everything works fine ....
 
Old 02-18-2010, 04:35 PM   #5
naaman
Member
 
Registered: Jun 2006
Posts: 84

Original Poster
Rep: Reputation: 16
Are you sure the lines where -F is used are the real problem ?
although they are not legal they work, because when I comment
the "porscan" bunch of commands everything works fine ....
 
Old 02-22-2010, 01:55 AM   #6
linuxgurusa
Member
 
Registered: Mar 2008
Location: Namibia, Swakopmund
Distribution: Redhat, Fedora, Centos, ClearOS, Mandrake
Posts: 151

Rep: Reputation: 29
The two scripts you have posted doesn't seem to be the same file ?

Anycase ..

The error you are getting is due to a IPTABLES chain that does not exist.

In you firewall script file you are running a IPTABLES command on a chain that does not exist.

$IPTABLES -N CHAINNAME is how you create a chain called "CHAINNAME"

$IPTABLES -F CHAINNAME is to flush any rules Apended to the chain, and like someone said, by creating a new chain and immediately flushing it does make sense.

If you want to "flush" all chains created (normally when you restart your firewall script, rather put the following in the top of your firewall script

$IPTABLES -F
$IPTABLES -F -t mangle
$IPTABLES -F -t nat
$IPTABLES -X
$IPTABLES -X -t mangle
$IPTABLES -X -t nat

SO go through the whole firewall script file, and maybe check for a misspelled chain name etc.


Quote:
Originally Posted by naaman View Post
Hello,

I try to make my own firewall with iptables but I get a problem.
I only need a very basic kind of firewall, but I decided to add something
else : I want my firewall to be able to log and block portscans... because I experienced some portscans. So, I found an already-made firewall on the web which allows that. Then I modified my own firewall with the one I found and now but I get a problem I don't understand ...

When I run the firewall I get this error :
Code:
* FireWall Starting ... ...
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
My firewall :

Code:
#!/bin/sh
$IPTABLES -P INPUT DROP
$IPTABLES -F INPUT
$IPTABLES -A INPUT -m state --state established -j ACCEPT
$IPTABLES -A INPUT -i lo -j ACCEPT

$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD

$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT

$IPTABLES -N check-flags
$IPTABLES -F check-flags
$IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -m limit \
      --limit 5/minute -j LOG --log-level alert --log-prefix "NMAP-XMAS:"
$IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -m limit --limit \
      5/minute -j LOG --log-level 1 --log-prefix "XMAS:"
$IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG \
      -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS-PSH:"
$IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -m limit \
      --limit 5/minute -j LOG --log-level 1 --log-prefix "NULL_SCAN:"
$IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -m limit \
      --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/RST:"
$IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit \
      --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/FIN:"
$IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
Could you help me ?

thanks,
 
1 members found this post helpful.
Old 02-23-2010, 02:20 AM   #7
naaman
Member
 
Registered: Jun 2006
Posts: 84

Original Poster
Rep: Reputation: 16
Yes I changed a bit the init script since the last time.

Thanks for your help, I'm gonna check --tce-flags' flags. Maybe one of them is not correct ....

I keep you in touch
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Searching for nice iptables commands for my firewall. jerryhardesty LinuxQuestions.org Member Intro 0 02-17-2010 05:25 PM
iptables commands sujitkale Linux - Networking 5 09-25-2007 01:42 PM
incorrect iptables commands? devel Linux - Networking 3 06-02-2005 09:35 PM
iptables save commands are not working tarheel92x Linux - Networking 1 01-19-2004 05:16 PM
iptables commands downlaw Linux - Networking 3 06-09-2003 01:43 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 08:56 PM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration