# IPtables Config File (-m udp Problems) (SOLVED)

## Kenji Miyamoto

IPtables claims that there's an error at the COMMIT line in the following text:

```
# Generated by iptables-save v1.3.5 on Tue Sep 26 06:44:15 2006

*raw

:PREROUTING ACCEPT [147:48081]

:OUTPUT ACCEPT [151:16715]

COMMIT

# Completed on Tue Sep 26 06:44:15 2006

# Generated by iptables-save v1.3.5 on Tue Sep 26 06:44:15 2006

*filter

:INPUT ACCEPT [146:47767]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [151:16715]

# Local Network

-A INPUT -s 127.0.0.1 -j ACCEPT

-A INPUT -s 192.168.1.0/24 -j ACCEPT

# Established

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# SSH

-A INPUT -p tcp -m state --state NEW -m tcp --dport 5130:5140 -j ACCEPT

# FTP/WebServer

-A INPUT -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

# XDMCP

-A INPUT -p tcp -m state --state NEW -m udp --dport 177 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 6000:6500 -j ACCEPT

# LiweVile

-A INPUT -p tcp -m state --state NEW -m tcp --dport 37418 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 6346 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m udp --dport 37418 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m udp --dport 6346 -j ACCEPT

#  up to 10 Bit-torrent connections

-A INPUT -p tcp -m state --state NEW -m tcp --dport 6881:6891 -j ACCEPT

# reject everything else

-A INPUT -j REJECT --reject-with icmp-port-unreachable

#

COMMIT
```

When I comment out every rule except the first three, there are no errors.  Where have I made a mistake?

----------

## tony

I'm no iptables guru but I do use it and here's a trick that always works for me.  Start by flushing out all of your tables and then re-insert the chains you have from the command line one at a time till one bombs.  If it takes all the chains without complaining then iptables-save > somefile and you're good to go.

```
iptables -F

iptables -A INPUT -s 127.0.0.1 -j ACCEPT

iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

.

.

.

-A INPUT -j REJECT --reject-with icmp-port-unreachable
```

The only bad part about this is that all your pretty comments are gone but you can always add them back in.

----------

## runningwithscissors

Why are you editing the autogenerated file?

Post the ruleset you're using to create it.

----------

## tony

That file is not always autogenerated.  And since it has comments it's definitely NOT autogenerated.  I know the file says "autogenerated" in it but autogeneration doesn't make comments, it's definitely been user modified.  I personally have turned off autogeneration when iptables exits and have edited that file directly so I know it's possible.

----------

## wjb

 *Quote:*   

> IPtables claims that there's an error at the COMMIT line in the following text

 

what does it say?

----------

## Kenji Miyamoto

 *runningwithscissors wrote:*   

> Why are you editing the autogenerated file?
> 
> Post the ruleset you're using to create it.

 That is the ruleset I'm using.

```
# iptables-restore /etc/iptables.bak

iptables-restore: line 37 failed
```

----------

## wjb

If you have changed kernel recently, check that the Network packet filtering config options are as expected.

I lost all the iptables commands with "state" a while back and it seemed to be because the state option under Netfilter was not set.

----------

## Kenji Miyamoto

I have the following matches compiled in:

```
#

# IP: Netfilter Configuration

#

CONFIG_IP_NF_CONNTRACK=y

# CONFIG_IP_NF_CT_ACCT is not set

# CONFIG_IP_NF_CONNTRACK_MARK is not set

# CONFIG_IP_NF_CONNTRACK_EVENTS is not set

# CONFIG_IP_NF_CT_PROTO_SCTP is not set

# CONFIG_IP_NF_FTP is not set

# CONFIG_IP_NF_IRC is not set

# CONFIG_IP_NF_NETBIOS_NS is not set

# CONFIG_IP_NF_TFTP is not set

# CONFIG_IP_NF_AMANDA is not set

# CONFIG_IP_NF_PPTP is not set

# CONFIG_IP_NF_H323 is not set

# CONFIG_IP_NF_SIP is not set

# CONFIG_IP_NF_QUEUE is not set

CONFIG_IP_NF_IPTABLES=y

CONFIG_IP_NF_MATCH_IPRANGE=y

CONFIG_IP_NF_MATCH_TOS=y

CONFIG_IP_NF_MATCH_RECENT=y

CONFIG_IP_NF_MATCH_ECN=y

CONFIG_IP_NF_MATCH_DSCP=y

CONFIG_IP_NF_MATCH_AH=y

CONFIG_IP_NF_MATCH_TTL=y

CONFIG_IP_NF_MATCH_OWNER=y

CONFIG_IP_NF_MATCH_ADDRTYPE=y

CONFIG_IP_NF_MATCH_HASHLIMIT=y

CONFIG_IP_NF_FILTER=y

CONFIG_IP_NF_TARGET_REJECT=y

CONFIG_IP_NF_TARGET_LOG=y

CONFIG_IP_NF_TARGET_ULOG=y

CONFIG_IP_NF_TARGET_TCPMSS=y

# CONFIG_IP_NF_NAT is not set

# CONFIG_IP_NF_MANGLE is not set

CONFIG_IP_NF_RAW=y

# CONFIG_IP_NF_ARPTABLES is not set
```

Do I need any more?

----------

## wjb

There are some more, CONFIG_NETFILTER_XT_MATCH_STATE is the one that bit me. 

Maybe see this bit of the gentoo wiki.

----------

## Kenji Miyamoto

The wiki is down at the moment.

I've already had said options set; sorry:

```
CONFIG_NETFILTER_XTABLES=y

CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y

CONFIG_NETFILTER_XT_TARGET_MARK=y

CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y

CONFIG_NETFILTER_XT_TARGET_NOTRACK=y

CONFIG_NETFILTER_XT_MATCH_COMMENT=y

# CONFIG_NETFILTER_XT_MATCH_CONNTRACK is not set

# CONFIG_NETFILTER_XT_MATCH_DCCP is not set

# CONFIG_NETFILTER_XT_MATCH_ESP is not set

CONFIG_NETFILTER_XT_MATCH_HELPER=y

CONFIG_NETFILTER_XT_MATCH_LENGTH=y

# CONFIG_NETFILTER_XT_MATCH_LIMIT is not set

CONFIG_NETFILTER_XT_MATCH_MAC=y

CONFIG_NETFILTER_XT_MATCH_MARK=y

# CONFIG_NETFILTER_XT_MATCH_POLICY is not set

CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y

# CONFIG_NETFILTER_XT_MATCH_PHYSDEV is not set

# CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set

# CONFIG_NETFILTER_XT_MATCH_QUOTA is not set

CONFIG_NETFILTER_XT_MATCH_REALM=y

# CONFIG_NETFILTER_XT_MATCH_SCTP is not set

CONFIG_NETFILTER_XT_MATCH_STATE=y

CONFIG_NETFILTER_XT_MATCH_STATISTIC=y

CONFIG_NETFILTER_XT_MATCH_STRING=y

# CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set
```

----------

## Kenji Miyamoto

The only cause for the error has to due with rules with -m udp, which I need.  How do I properly deal with the UDP protocol?

----------

## hollyo

What is -m tcp and -m udp supposed to do? I use for protocol definition -p tcp , -p udp or -p icmp....

So you say:  look for protocol tcp and then match udp

Odd, you dont need the whole -m tcp/upd thing if you define your protocol with -p

----------

## Kenji Miyamoto

 *hollyo wrote:*   

> Odd, you dont need the whole -m tcp/upd thing if you define your protocol with -p

 I guess the wiki is a bit off on that.

----------

