# newbie : iptables issue

## passoionatetech

kernel: 2.6.22-gentoo-r5

iptables version: 1.3.8

I have enabled the following in my kernel as inbuilt support 

```
Networking  ---->

 Networking options  ---->

  Network packet filtering framework (Netfilter)--->

   Core Netfilter Configuration ---->

    ["enable"] Netfilter connection tracking support--->Layer 3 Independent Connection tracking

    ["enable"] Netfilter Xtables support (required for ip_tables)

    ["enable"] "state" match support 

   IP: Netfilter Configuration --->

    ["enable"] IPv4 connection tracking support (required for NAT) required by "Layer 3 Independent Connection tracking" above (caused many headaches)

    ["enable"] IP tables support (required for filtering/masq/NAT)

    ["enable"] Packet Filtering

     ["enable"] Reject Target Support
```

and I have also enabled FULL NAT in kernel under Network options 

Now when I pass the command 

```
grep -i netfilter /usr/src/linux/.config
```

 I am getting the following output 

```
CONFIG_NETFILTER=y

# CONFIG_NETFILTER_DEBUG is not set

# Core Netfilter Configuration

# CONFIG_NETFILTER_NETLINK is not set

CONFIG_NETFILTER_XTABLES=y

# CONFIG_NETFILTER_XT_TARGET_CLASSIFY is not set

# CONFIG_NETFILTER_XT_TARGET_MARK is not set

# CONFIG_NETFILTER_XT_TARGET_NFQUEUE is not set

# CONFIG_NETFILTER_XT_TARGET_NFLOG is not set

# CONFIG_NETFILTER_XT_TARGET_TCPMSS is not set

# CONFIG_NETFILTER_XT_MATCH_COMMENT is not set

# CONFIG_NETFILTER_XT_MATCH_CONNBYTES is not set

# CONFIG_NETFILTER_XT_MATCH_CONNMARK is not set

# CONFIG_NETFILTER_XT_MATCH_CONNTRACK is not set

# CONFIG_NETFILTER_XT_MATCH_DCCP is not set

# CONFIG_NETFILTER_XT_MATCH_DSCP is not set

# CONFIG_NETFILTER_XT_MATCH_ESP is not set

# CONFIG_NETFILTER_XT_MATCH_HELPER is not set

# CONFIG_NETFILTER_XT_MATCH_LENGTH is not set

# CONFIG_NETFILTER_XT_MATCH_LIMIT is not set

# CONFIG_NETFILTER_XT_MATCH_MAC is not set

# CONFIG_NETFILTER_XT_MATCH_MARK is not set

# CONFIG_NETFILTER_XT_MATCH_POLICY is not set

# CONFIG_NETFILTER_XT_MATCH_MULTIPORT is not set

# CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set

# CONFIG_NETFILTER_XT_MATCH_QUOTA is not set

# CONFIG_NETFILTER_XT_MATCH_REALM is not set

# CONFIG_NETFILTER_XT_MATCH_SCTP is not set

CONFIG_NETFILTER_XT_MATCH_STATE=y

# CONFIG_NETFILTER_XT_MATCH_STATISTIC is not set

# CONFIG_NETFILTER_XT_MATCH_STRING is not set

# CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set

# CONFIG_NETFILTER_XT_MATCH_HASHLIMIT is not set

# IP: Netfilter Configuration

# IPv6: Netfilter Configuration (EXPERIMENTAL)
```

Have I rightly configured my kernel to have inbuilt IPTABLES support?

My iptables configuration is as follows (Very simple one just for testing) :

```
# Generated by iptables-save v1.3.8 on Tue Sep  4 17:50:37 2007

*nat

:PREROUTING ACCEPT [8:1397]

:POSTROUTING ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

COMMIT

# Completed on Tue Sep  4 17:50:37 2007

# Generated by iptables-save v1.3.8 on Tue Sep  4 17:50:37 2007

*filter

:INPUT ACCEPT [24:3476]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

# Completed on Tue Sep  4 17:50:37 2007i

-A INPUT -s 127.0.0.1 -j ACCEPT

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

COMMIT
```

 Regards

----------

## nixnut

Moved from Other Things Gentoo to Networking & Security.

Networking stuff, so moved here.

----------

## Rob1n

 *passoionatetech wrote:*   

> Have I rightly configured my kernel to have inbuilt IPTABLES support?

 

Looks okay to me - it's going to depend on what your rules are going to be as to whether you need to enable any of the other match/target options though.

----------

## JeanValjean

hmmm, I think conntrack is necessary.  If you're maybe a couple more.  The iptables for newbies isn't a bad wiki.  Also I found this one useful.

----------

