# iptables states stoped working

## Black

Hi everyone,

I've got an issue all of a sudden with iptables, and I can't figure it out: this morning, after a reboot, iptables doesn't recognize the "-m state" anymore.  I didn't update the kernel for some time (except after I got this problem, in an attempt to solve it).  All other rules work fine.

```
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
```

That works.

```
iptables -A INPUT -m state --state RELATED -j ACCEPT

iptables: Invalid argument
```

Now I did a lot of attempts at solving it, including recompiling the kernel (to a more recent version), recompiling iptables, trying the conntrack option instead, but so far, nothing works.

Here's something that bugs me. If I do:

```
iptables -A INPUT -m state

iptables v1.3.8: You must specify `--state'
```

Ok good, iptables understand state. Now if I add `--state':

```
iptables -A INPUT -m state --state

iptables v1.3.8: Unknown arg `--state'
```

Now I know that the above command is not a complete command, but the error message (Unknown arg) tells me iptables doesn't know that - yet it understood the "-m state" just before. If I add the state (NEW, RELATED, ESTABLISHED, whatever), I end up with the "Invalid argument" above.

I looked at my config, but considering I did not compile for a few months before this happened, I don't see how this is kernel-related. I have everything built-in (as opposed to a module), and I do have the "state" match support checked in the Code Netfilter Configuration page.

I haven't been able to find a solution on Google.

Anyone has a hint for me?

----------

## Hu

What is the output of uname -a ; zgrep STATE /proc/config.gz?

----------

## Black

 *Quote:*   

> veronica ~ # uname -a ; zgrep STATE /proc/config.gz
> 
> Linux veronica 2.6.24-gentoo-r3 #3 Fri Apr 4 15:57:16 EDT 2008 i686 Intel(R) Celeron(R) CPU 1.70GHz GenuineIntel GNU/Linux
> 
> CONFIG_NETFILTER_XT_MATCH_STATE=y
> ...

 

----------

## Hu

Strange.  What is the output of zgrep -E '^[^#]' /proc/config.gz ; emerge --info ; emerge --pretend --verbose net-firewall/iptables ; iptables-save -c ; strace -s 2048 -tt -v -x iptables -A INPUT -m state --state RELATED -j ACCEPT?

----------

## Black

 *Hu wrote:*   

> Strange.  What is the output of zgrep -E '^[^#]' /proc/config.gz ; emerge --info ; emerge --pretend --verbose net-firewall/iptables ; iptables-save -c ; strace -s 2048 -tt -v -x iptables -A INPUT -m state --state RELATED -j ACCEPT?

 

Ok, let's take it in steps:

 *Quote:*   

> zgrep -E '^[^#]' /proc/config.gz
> 
> CONFIG_X86_32=y
> 
> CONFIG_X86=y
> ...

 

 *Quote:*   

> emerge --info
> 
> Portage 2.1.4.4 (default-linux/x86/2006.1, gcc-4.1.2, glibc-2.6.1-r0, 2.6.24-gentoo-r3 i686)
> 
> =================================================================
> ...

 

 *Quote:*   

> emerge --pretend --verbose net-firewall/iptables
> 
> These are the packages that would be merged, in order:
> 
> Calculating dependencies... done!
> ...

 

 *Quote:*   

> iptables-save -c
> 
> # Generated by iptables-save v1.3.8 on Sat Apr  5 19:12:23 2008
> 
> *filter
> ...

 

CUSTOMSSH is to allow myself to SSH in remotely without opening the port at large, but now I've flushed all rules so that I can access the Internet. Don't worry, I'm behind another firewall (IPCop), and I disabled the SSH port forwarding just to be on the safe side.

The strace output was messing up the display in the forums, so I word-wrapped, and put an extra carriage return at the beginning of each line.

 *Quote:*   

> strace -s 2048 -tt -v -x iptables -A INPUT -m state --state RELATED -j ACCEPT
> 
> 19:12:47.097054 execve("/sbin/iptables", ["iptables", "-A", "INPUT", "-m",
> 
> "state", "--state", "RELATED", "-j", "ACCEPT"],
> ...

 

Thanks!

----------

## DarKRaveR

As far as I can see the state module gets loaded by iptables, but when setting the rule, the kernel seems to reject it.

Does 'cat /proc/net/ip_tables_matches' list state ?

----------

## Black

 *DarKRaveR wrote:*   

> As far as I can see the state module gets loaded by iptables, but when setting the rule, the kernel seems to reject it.
> 
> Does 'cat /proc/net/ip_tables_matches' list state ?

 

Yes, it does:

 *Quote:*   

> veronica ~ # cat /proc/net/ip_tables_matches
> 
> icmp
> 
> state
> ...

 

----------

## albright

this is very naive advice but I wonder what would happen if

you switched from CONFIG_NETFILTER_XT_MATCH_STATE being

built in to a module ...

----------

## Black

 *albright wrote:*   

> this is very naive advice but I wonder what would happen if
> 
> you switched from CONFIG_NETFILTER_XT_MATCH_STATE being
> 
> built in to a module ...

 

I'll have to try that next weekend because I'm leaving for a few days. I'll post back then.

Thanks!

----------

## e_thor

I got the same "invalid argument" results when trying to use the state module with kernel-2.6.24_rc5.

rc4 does not work for me at all - hangs the system when connecting wlan with iwconfig.

Without compiled xt_state support there were no hangs with rc4.

----------

## Hu

Try using the conntrack match instead.  It seems to offer all the functionality of the state match.  I switched my NAT rules over to it a few kernels back and have had no problems with it.

----------

## Black

Conntrack doesn't work for me.

 *Quote:*   

> veronica ~ # iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
> 
> iptables: Invalid argument

 

I haven't had time to try building the match_state into a module yet, as albright suggested. I guess I could also try downgrading to an older kernel.

----------

## helamonster

I'm having the same problem. Has anyone ever found a solution for this?

----------

## Sevalecan

I'm experiencing the same problem too. I've tried it with iptables 1.4.0 and vanilla kernel 2.6.24.2 and also with iptables 1.4.1.1 and vanilla kernel 2.6.26.2 and I get the same thing. I also tried using conntrack instead of state and I get the same result.  Been a few months since this was posted. In reality I could've had the problem before, I haven't had iptables up and running on that machine for a while.

And still no one has any ideas on this? I don't feel like rummaging through someone else's code.   :Confused: 

EDIT:

Ok, tried another search on the forums and found what we all needed to know.

https://forums.gentoo.org/viewtopic-t-590177-start-0-postdays-0-postorder-asc-highlight-state+iptables+invalid+argument.html

But, I'm assuming all this is caused by the problem mentioned here:

https://forums.gentoo.org/viewtopic-t-630878-highlight-state+iptables+invalid+argument.html

Hope everyone's happy.   :Razz: 

Now I'm going to sit and recompile my kernel with automatic module loading and see what happens(can't imagine why I'd have it turned off to begin with, oh well).

----------

