# [SOLVED]Iptables? slackware->gentoo not working

## FizzyWidget

Hello all

First time poster and gentoo user here, loving gentoo btw, its so easy once you get the right use flags....anyway

I have moved from slackware to gentoo, and have placed my iptables rules in rules-save but it seems that things are done diffently on gentoo and it doesnt seem to like a lot of the rules, i have googled and looked through the forums, but due to my limited ability to learn all i see is a mass of code and no understanding of it.

Could some nice person look over the code below and point me in the direction of what needs to be changed? Thanks

```
#!/bin/bash

ext_if=eth0

int_if=eth1

iptables -F INPUT

iptables -P INPUT DROP

iptables -F OUTPUT

iptables -F FLUSH

iptables -A INPUT -i eth0 -m state -state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p udp -m state -state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -p udp -m state -state NEW,ESTABLISHED -j ACCEPT

iptables -A INPUT -p tcp -m state -state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -p tcp -m state -state NEW,ESTABLISHED -j ACCEPT

iptables -A INPUT -i lo -j ACCEPT

accept_port="21 80 443 2010 6300:6320"

names="some.dns.name1 some.dns.name2"

iptables -A INPUT -i $ext_if -j DROP

iptables -A INPUT -i $int_if -s 164.168.1.1/24 -j ACCEPT

iptables -A INPUT -i $ext_if -s 192.168.1.1/24 -j ACCEPT

for ip in $names

do

for port in $accept_ports

do

iptables -A INPUT -i $ext_if -s $ip -dport $ip -syn -m state -state NEW -j ACCEPT

done

done
```

Last edited by FizzyWidget on Fri Nov 21, 2008 10:34 pm; edited 1 time in total

----------

## thestick

run this script as root and then

run as root iptables-save

then rc-update add iptables default

this should do it

alternatively you could paste this code into /etc/conf.d/local.start

----------

## FizzyWidget

OK i tried the first suggestion,

runing the script as root i get

carp-serv ~ # ./firewall.sh

iptables: No chain/target/match by that name

Bad argument `ESTABLISHED,RELATED'

Try `iptables -h' or 'iptables --help' for more information.

and then all connections to the box are killed and i cant get back on  :Sad: 

when i do get back on iptables-save gives me

carp-serv ~ # iptables-save

# Generated by iptables-save v1.4.0 on Fri Nov 21 12:42:37 2008

*filter

:INPUT ACCEPT [44:4766]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [38:5607]

COMMIT

# Completed on Fri Nov 21 12:42:37 2008

adding it to default goes fine, its just that when i reboot the box and try to connect i am blocked again and i have to turn iptables off.

Where does it save these rules as i have looked in rules-save and all the rules arent there, should i just re-add all the rules to that file ?

As to your second suggestion do you mean i paste the code into local "as is" ?Last edited by FizzyWidget on Fri Nov 21, 2008 12:48 pm; edited 1 time in total

----------

## i92guboj

Well, the thing is easier than it seems.

First you run "iptables -F" to clean your iptables rules, then you run your script, you shouldn't need to change anything on it. After that, "/etc/init.d/iptables save". After that you only need to make sure that iptables is started on every reboot, that can be done this way:

```
rc-update add iptables default
```

To add it to the default runlevel.

The only probable problem is when running your script. Iptables scripts assume that all the needed modules are there. If they aren't, then a given tables can't be initialized or a similar problem occurs. But first, try it. If something failt, report back, paste the errors so we can know what failed. It's possible that some netfilter stuff is missing in your kernel if you compiled it yourself.

PS: I am way too lazy to go hunting iptables targets, so I just include them all in my kernel config as modules. They are all under the "Network packet filtering framework (Netfilter)" section.

----------

## FizzyWidget

i normally compile my own kernel but seeing its my first time on gentoo i didnt really want to mess about in there as it was working, so i just used genkernel, should i try and use the 2.6.25 .config file i had when i was on slackware and see if that helps? if so is there a step by step guide (in the handbook possibly) for building and installing your own kernel on gentoo? Please not as i say i am new to gentoo so a really easy to follow dumbed down version would be best  :Smile: 

sometimes i do change the parms on the script to thats why i put the flush option there

Errors

carp-serv ~ # ./firewall.sh

iptables: No chain/target/match by that name

Bad argument `ESTABLISHED,RELATED'

Try `iptables -h' or 'iptables --help' for more information.

Bad argument `ESTABLISHED'

Try `iptables -h' or 'iptables --help' for more information.

Bad argument `NEW,ESTABLISHED'

Try `iptables -h' or 'iptables --help' for more information.

now if i add the rules directly to rules save and try to run the firewall i get.....

 * Loading iptables state and starting firewall ...

iptables-restore: line 2 failed

and everytime after that i get the same error but on a different line, so if i comment out line 2 - line 3 is wrong and so on and so forth

----------

## i92guboj

 *Carps wrote:*   

> i normally compile my own kernel but seeing its my first time on gentoo i didnt really want to mess about in there as it was working, so i just used genkernel, should i try and use the 2.6.25 .config file i had when i was on slackware and see if that helps? if so is there a step by step guide (in the handbook possibly) for building and installing your own kernel on gentoo? Please not as i say i am new to gentoo so a really easy to follow dumbed down version would be best 
> 
> 

 

Maybe it could help, though I don't really know. I am not familiar with genkernel (I've never used it). I always used the same method to build the kernels for all my distros (in fact, I commonly share the boot partition and kernels across all of them). Just copy the .config from slackware, make oldconfig, make, make install modules_install and change grub as you wish.

 *Quote:*   

> sometimes i do change the parms on the script to thats why i put the flush option there

 

That's a good thing, to make sure there're no leftovers from a previous run.

 *Quote:*   

> 
> 
> iptables: No chain/target/match by that name
> 
> 

 

Most iptables errors are related to this. It just means that iptables can't locate a given table. Iptables modules can be loaded by iptables on the fly if they are present, and then the relevant tables are available. I just put them all in my kernel. If you don't want to take the slack config, you can just use genkernel --menuconfig all, and make sure that all the netfilter modules are there. Until the needed stuff is there, iptables will complain each time you try to apply those rules, it doesn't matter if it's via a hand made script or the gentoo init system. So, I wouldn't bother about the init stuff until your script can run cleanly.

----------

## FizzyWidget

well i messed that up - system wont boot now as it says it can mount the root device guess i forgot to make a initramfs, how would i fix that using the live cd disc ? Mind you compiling ext2 and 3 into the kernel you wouldnt expect the need for one would you, although i did check and all the entries under netfilter both ip4 and ip6 are set to be built as modules, should i have changed that to built in ?

----------

## i92guboj

 *Carps wrote:*   

> well i messed that up - system wont boot now as it says it can mount the root device guess i forgot to make a initramfs, how would i fix that using the live cd disc ? Mind you compiling ext2 and 3 into the kernel you wouldnt expect the need for one would you, although i did check and all the entries under netfilter both ip4 and ip6 are set to be built as modules, should i have changed that to built in ?

 

As long as all you need to boot is in kernel, there shouldn't be a need for an initramfs (I don't use one).

Common things that you need are, at least, the driver for your chipset' harddisk controller (either IDE or SATA) and the involved fs's. 

About the netfilter stuff, I build them as modules, and they get autoloaded when needed. I haven't experienced any problem so far.

----------

## FizzyWidget

i have tried 2.6.25 and 2.6.27 using my own config files and genkernel, and after a few mishaps all is working in the hardware department but still getting the same errors as above, after some googling and looking in the gentoo handbook it looks as if the sytanx for certain commands are different, either that or its my poor old eyes bluring everything after hours of looking at small text  :Wink: 

Im out of ideas now - iptables is all there in the kernel all [M]  :Sad: 

----------

## FizzyWidget

going to see if i can get http://www.gentoo.org/doc/en/home-router-howto.xml to work - only thing is, that since i recompiled kernel glftpd doesnt wont to work :/

----------

## i92guboj

I looked around in menuconfig and these matches are given by CONFIG_NETFILTER_XTABLES. Is it enabled in your kernel? Has the module been installed? If so, what happens if you manually modprobe it (modprobe x_tables)?

I use a similar rule on my firewall and it works.

```

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

```

----------

## FizzyWidget

ah!! that works - you are a star sir, guess i best put that module in auto load, and write this down so i remember in future, big test is will it all work :p

one problem down one to go  :Smile:  tv card is next  :Smile: 

----------

## i92guboj

Hehe, nice that it worked.

If you don't want to bother with the autoload you could as well put that static into the kernel instead of putting it as module. It's strange that it didn't work though. However, at least now we know where to look around.

See you around  :Wink: 

----------

## FizzyWidget

i think i may have found what it was also, im almost too ashamed to say it, looks like a typo or something has changed

-state it doesnt like

--state it does like

its strange as its the same version as on slackware, still its another area we can note for future reference  :Smile: 

strange how it doesnt like the last part of the script, but accepts

# Completed on Fri Nov 21 20:14:52 2008

# Generated by iptables-save v1.4.0 on Fri Nov 21 20:14:52 2008

*filter

:INPUT DROP [1:40]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [651:102251]

-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT

-A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -i eth0 -j DROP

-A INPUT -s 164.168.1.0/24 -i eth1 -j ACCEPT

-A INPUT -s 192.168.1.0/24 -i eth0 -j ACCEPT

-A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT

-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT

COMMIT

but not

accept_port="21 80 443 2010 6300:6320"

names="some.dns.name1 some.dns.name2"

iptables -A INPUT -i $ext_if -j DROP

iptables -A INPUT -i $int_if -s 164.168.1.1/24 -j ACCEPT

iptables -A INPUT -i $ext_if -s 192.168.1.1/24 -j ACCEPT

for ip in $names

do

for port in $accept_ports

do

iptables -A INPUT -i $ext_if -s $ip -dport $ip -syn -m state -state NEW -j ACCEPT

done

done

guess i will have to do on gentoo what i did on freebsd

iptables -A INPUT -p TCP -i ! ext_if -s friends.ip.addy --dport 80 -j ACCEPT

iptables -A INPUT -p TCP -i ! ext_if -s friends.ip.addy --dport 2010 -j ACCEPT

ect..

Thanks for the help i92guboj

----------

