# iptables: No chain/target/match [solved]

## mr4v0

Hello,

I'm trying to set up iptables and I keep getting this error. *Quote:*   

> iptables: No chain/target/match by that name

  when I type this *Quote:*   

> iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED

 Now, what's this all about? Other tables work ok, it's just when I try the "-m" switch (or with "-m limit...") I get that error. So I thought I haven't compiled it alright and I did once more with USE="extensions". Please help, thanks.Last edited by mr4v0 on Tue Sep 04, 2007 2:00 pm; edited 1 time in total

----------

## massimo

Propably a missing option in your kernel configuration.

```

    Symbol: NETFILTER_XT_MATCH_STATE [=m]                                                                                                              │

  │ Prompt: "state" match support                                                                                                                      │

  │   Defined at net/netfilter/Kconfig:595                                                                                                             │

  │   Depends on: NET && INET && NETFILTER && NETFILTER_XTABLES && NF_CONNTRACK                                                                        │

  │   Location:                                                                                                                                        │

  │     -> Networking                                                                                                                                  │

  │       -> Networking support (NET [=y])                                                                                                             │

  │         -> Networking options                                                                                                                      │

  │           -> Network packet filtering framework (Netfilter) (NETFILTER [=y])                                                                       │

  │             -> Core Netfilter Configuration                                                                                                        │

  │               -> Netfilter Xtables support (required for ip_tables) (NETFILTER_XTABLES [=m])

```

----------

## mr4v0

Yes, I've found it, after I've applied the imq patch. I have included "state, limit and mport" as modules now, think it should work now.

Thanks for the quick reply!

----------

## Moreaulf

Where do you find "state, limit and mport"? I find"

"limit" match support

but none of the others... 

My kernel is configured like massimo states in the Code-section.

Thanks,

/Thomas

----------

## massimo

@Moreaulf

Which sources are you using?

----------

## Moreaulf

Hi massimo,

I updated the linux-sources last week, running 2.6.22-r5 at the moment.

/Thomas

----------

## massimo

limit and state should be there (in Core Netfilter Configuration-->Netfilter Xtables support). I am not absolutely sure but I guess mport was dropped some time ago.

----------

## Moreaulf

Here's my Core Netfilter Support info:

```
<M> Netfilter netlink interface

<M>   Netfilter NFQUEUE over NFNETLINK interface

<M>   Netfilter LOG over NFNETLINK interface

< > Netfilter connection tracking support

<*> Netfilter Xtables support (required for ip_tables)

<M>   "CLASSIFY" target support

<M>   "DSCP" target support

<M>   "MARK" target support

<M>   "NFQUEUE" target Support

< >   "NFLOG" target support

<M>   "SECMARK" target support

< >   "TCPMSS" target support

<M>   "comment" match support

<M>   "DCCP" protocol match support

<M>   "DSCP" match support

<M>   "ESP" match support

<M>   "length" match support

<M>   "limit" match support

<M>   "mac" address match support

<M>   "mark" match support

<M>   IPsec "policy" match support

<M>   Multiple port match support

< >   "physdev" match support

<M>   "pkttype" packet type match support

<M>   "quota" match support

<M>   "realm" match support

<M>   "sctp" protocol match support (EXPERIMENTAL)

<M>   "statistic" match support

<M>   "string" match support

<M>   "tcpmss" match support

< >   "hashlimit" match support
```

There should be a "state" match support in these options? What in that case other than the linux-sources, which is 2.6.22-r5, could be the reason for this option not to be displayed?

Thanks,

/Thomas[/code]

----------

## massimo

You have to activate Netfilter connection tracking support.

----------

## Moreaulf

I see!

Any of these:

```
[ ] Connection tracking flow accounting (NEW)

[ ] Connection mark tracking support (NEW)

[ ] Connection tracking security mark support (NEW)

[ ] Connection tracking events (EXPERIMENTAL) (NEW)

< > SCTP protocol connection tracking support (EXPERIMENTAL) (NEW)

< > Amanda backup protocol support (NEW)

< > FTP protocol support (NEW)

< > H.323 protocol support (EXPERIMENTAL) (NEW)

< > IRC protocol support (NEW)

< > NetBIOS name service protocol support (EXPERIMENTAL) (NEW)

< > PPtP protocol support (NEW)

< > SANE protocol support (EXPERIMENTAL) (NEW)

< > SIP protocol support (EXPERIMENTAL) (NEW)

< > TFTP protocol support (NEW)

< > Connection tracking netlink interface (EXPERIMENTAL) (NEW)
```

?

----------

## massimo

If you activate Netfilter connection tracking support additional modules, e.g. state, will be available within the Netfilter Xtables support section.

----------

## Moreaulf

I enabled these as Modules and I recompiled the kernel. Booting was OK and now:

```
# iptables -A INPUT -p udp --dport 500 -m state --state NEW -j ACCEPT

iptables: Invalid argument
```

Which argument is that?

 *Quote:*   

> tail -n 1 /var/log/messages
> 
> Sep  6 13:23:28 ******** can't load conntrack support for proto=2

 

----------

## massimo

What gives you lsmod?

Is xt_state loaded?

----------

## Moreaulf

This is the first lines of lsmod

```
# lsmod

Module                  Size  Used by

xt_state                5504  0

nf_conntrack           33416  1 xt_state

xt_tcpudp               6144  0

iptable_filter          5760  0

ip_tables              13380  1 iptable_filter

x_tables               11652  3 xt_state,xt_tcpudp,ip_tables
```

----------

## massimo

Is IPv4 connection tracking support (required for NAT) enabled?

```

  │ Symbol: NF_CONNTRACK_IPV4 [=m]

  │ Prompt: IPv4 connection tracking support (required for NAT)

  │   Defined at net/ipv4/netfilter/Kconfig:8

  │   Depends on: NET && INET && NETFILTER && NF_CONNTRACK

  │   Location:

  │     -> Networking

  │       -> Networking support (NET [=y])

  │         -> Networking options

  │           -> Network packet filtering framework (Netfilter) (NETFILTER [=y])

  │             -> IP: Netfilter Configuration

```

----------

## Moreaulf

Many thanks massimo! Now the command works  :Smile: 

What I need iptables for is for a IPSec VPN. I made a post about this here: VPN with IPSec

Thanks once again![/post]

----------

