Introduction
If you encounter such error, it means that the CONFIG_NETFILTER module was not complied in your kernel. All VPS (virtual private server) that I owned from DigitalOcean, AWS, Google Cloud and other lesser-known host providers have it by default when I choose Ubuntu or Debian. However, I owned an OpenVZ (Open Virtuozzo) from a particular provider and it was absent from Debian 9.
Error 1 – iptables: No chain/target/match by that name
If the module is not loaded, using iptables with -m conntrack –ctstate ESTABLISHED,RELATED will cause this error. Note that CONFIG_PACKET is not needed for iptables to work. You can read more about Linux Packet Filtering and iptables at linuxtopia.org
user@server:~$ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables: No chain/target/match by that name.
user@server:~$ sudo iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables: No chain/target/match by that name.Error 2 – apt-get update Cannot initiate the connection to and Temporary failure resolving repository
If the option -m conntrack –ctstate is not available on the server, you will have to omit them from the iptables command. While the firewall rules will now be accepted without error but by simply removing them will cause two problems when running apt-get. They are fail to resolve e.g. ftp.us..debian.org and connection timed out trying to connect to repository.
user@server:~$ sudo apt-get update
Err:1 http://ftp.us..debian.org/debian oldstable InRelease
Could not resolve 'ftp.us..debian.org'
user@server:~$ sudo apt-get update
Err:1 https://packages.sury.org/php stretch InRelease
Failed to connect to packages.sury.org port 443: Connection timed out
0% [Connecting to prod.debian.map.fastly.net (151.101.24.204)] [Connecting to security.debian.org (151.101.0.204)] Solution
The solution is to add six additional firewall rules (Step 1) associated to Port 53 (DNS), 80 (HTTP) and 443 (HTTPS) to replace the absence of these two rules rejected on servers without netfilter (CONFIG_PACKET) complied.
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPTStep 1 – Firewall Rules for Servers without Netfilter Module
Don’t be in a hurry to enter these rules yet! This command iptables -P INPUT DROP will drop you out of your current SSH session and you will require serial console to gain access to update the rule back to iptables -P INPUT ACCEPT before you can reconnect via SSH again.
# Flush all existing rules
iptables -F
# Set 'close all ports' chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
# apt-get to resolve (53) and initiate connections (80, 443) to fetch updates from repo
iptables -A INPUT -p udp --sport 53 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --sport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --sport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
# Accept all incoming SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
# Accept all incoming HTTP
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT
# Accept all incoming HTTPS
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 443 -j ACCEPT
# Enable SMTPS for e.g. Postfix
iptables -A INPUT -p tcp --sport 465 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 465 -j ACCEPT
# Accept incoming PING
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
# Accept loopback access
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPTStep 2 – Using iptables-restore to Import Rules
Create a file e.g. fw-rules and use iptables-restore < fw-rules to import the rules below which only allow incoming SSH connections via Port 22, web services Port 80/ 443, SMTPS (Simple Mail Transfer Protocol Secure) Port 465 and ICMP ping. The rest of the network packets will be dropped.
*filter
:INPUT DROP
:FORWARD DROP
:OUTPUT DROP
# For apt-get to resolve (53) and initiate connections (80, 443)
# to fetch updates from repository
-A INPUT -p udp --sport 53 -j ACCEPT
-A OUTPUT -p udp --dport 53 -j ACCEPT
-A INPUT -p tcp --sport 80 -j ACCEPT
-A OUTPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --sport 443 -j ACCEPT
-A OUTPUT -p tcp --dport 443 -j ACCEPT
# Accept SSH, HTTP, HTTPS, SMTPS and ICMP ping
-A INPUT -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -j ACCEPT
-A INPUT -p tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp --sport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp --sport 443 -j ACCEPT
-A INPUT -p tcp --sport 465 -j ACCEPT
-A OUTPUT -p tcp --dport 465 -j ACCEPT
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
-A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
COMMITYou can list your rules for your first firewall with iptables -L
user@server:~$ sudo iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp spt:domain
ACCEPT tcp -- anywhere anywhere tcp spt:http
ACCEPT tcp -- anywhere anywhere tcp spt:https
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT tcp -- anywhere anywhere tcp spt:ssh
ACCEPT tcp -- anywhere anywhere tcp spt:http
ACCEPT tcp -- anywhere anywhere tcp spt:https
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT all -- anywhere anywhereStep 3 – (optional) How to Check CONFIG_NETFILTER is Compiled into Kernel
On a KVM (Kernel-based Virtual Machine) with Debian 10 that I owned which returns that the CONFIG_NETFILTER was complied.
user@server:~$ grep CONFIG_NETFILTER= /boot/*config*
/boot/config-4.19.0-5-amd64:CONFIG_NETFILTER=y
/boot/config-4.19.0-8-amd64:CONFIG_NETFILTER=yOn OpenVZ (Open Virtuozzo) with Debian 9 that I owned which returns no such file or directory. This can be due to OpenVZ shares a single kernel which is always maintained by the host provider which end-users have no access to. In any case, option –ctstate is not available on this server for me.
user@server:~$ grep CONFIG_NETFILTER= /boot/*config*
grep: /boot/*config*: No such file or directoryConclusion
I had actually spent hours debugging how to get apt-get to work for this particular server of mine without netfilter module. I had tried to add all suggested firewall rules from the Internet even for Port 21 (FTP) but none worked for me. They are all but just a fraction of the bigger solution required which I conclude is to add those six firewall rules for Port 53, 80 and 443. Last but not least, rules stored in iptables are not persistent, they will be deleted (flushed) on next server reboot. Install iptables-persistent package to save the existing rules to a file and load it on every startup.
You need to figure out which part of the rule is causing that error message. It’s probably the -m state part, but not necessarily. The various extensions to iptables and netfilter have to be compiled into the iptables userspace binary and into netfilter in the Linux kernel. You can determine which part you are missing by asking iptables for the help information on the extension you are testing. Here are some ways to test for the various extensions:
$ iptables -m state -h
$ iptables -p icmp -h
$ iptables -j DROP -h
If you get help output that includes information about the extension at the very bottom of the output, then it is compiled into the userspace binary. If not, then you need to recompile iptables. If that works, try the simplest possible rule to see if the extension is included in the kernel space:
$ iptables -A INPUT -m state --state NEW
$ iptables -A INPUT -p icmp
$ iptables -A INPUT -j DROP
(Careful with those rules, the last one you’ll want to remove because it will probably DROP more than you want to!) When you get the error message again: No chain/target/match by that name you’ll know that particular extension is not compiled into your kernel. You’ll need to recompile your kernel.
Look through the make files in linux/net/ipv6/netfilter, linux/net/ipv4/netfilter, and linux/net/netfilter for options on enabling various extensions for the kernel. For the userspace, I think the make files in question are in iptables/extensions but I think the folder structure has changed a little in more recent versions.
I am trying to configure iptables on my Ubuntu 12.04 LTS server to forward port 443 to 8443.
But when I run this command:
sudo iptables -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443
I get the following error:
iptables: No chain/target/match by that name.
My iptables current configuration:
$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:https
DROP tcp -- anywhere anywhere tcp dpt:http
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
What am I missing or doing wrong?
heemayl
88.8k19 gold badges195 silver badges262 bronze badges
asked Jun 30, 2016 at 18:39
Because PREROUTING chain belongs to the NAT table, not the FILTER table. If you do not mention any table explicitly by -t option, then FILTER is assumed.
So, you need to mention the table type with -t nat:
sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443
Note that, MANGLE and RAW tables also have PREROUTING chain but as you are redirecting ports only, you are presumably looking for the NAT table.
answered Jun 30, 2016 at 18:46
heemaylheemayl
88.8k19 gold badges195 silver badges262 bronze badges
4
PREROUTING chain only available for nat, mangle and raw tables.
iptables assumes filter table, so you must specify one of these, eg. iptables -t nat ...
answered Jun 30, 2016 at 18:47
Ven3kVen3k
713 bronze badges
I get similar error when I run a docker command
docker run -d -p 8084:8080 knockdata/zeppelin-highcharts
d9c5d34f500d621585470b0e70b915395fcb6b3437859e0f610dbb58d51faf25
docker: Error response from daemon: driver failed programming external connectivity on endpoint elegant_jang
(7ca0f5ad689f5443ce7533f66b4a86c34d2dbd9d076bac4812288dd3f6a76698):
iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 8084 -j DNAT --to-destination 172.17.0.2:8080
! -i docker0: iptables: No chain/target/match by that name.
(exit status 1).
I was able to fix it by reinstall docker-engine
apt-get remove docker-engine
apt-get install docker-engine
answered Sep 29, 2016 at 7:22
You can install (Config Server Security & Firewall) and use the following settings.
nano /etc/csf/csf.conf
SYNFLOOD = "" => SYNFLOOD = "1"
CONNLIMIT = "" => CONNLIMIT = "80;75,443;75,21;50”
PORTFLOOD = "" => PORTFLOOD = "80;tcp;5;250"
SYSLOG = “0” => SYSLOG = "1"
DOCKER = “0” => DOCKER = "1"
nano /etc/csf/csfpost.sh
#!/bin/sh
echo "[DOCKER] Setting up FW rules."
iptables -N DOCKER
iptables -t nat -N DOCKER
iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
# Masquerade outbound connections from containers
iptables -t nat -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
# Accept established connections to the docker containers
iptables -t filter -N DOCKER
iptables -t filter -A FORWARD -o docker0 -j DOCKER
iptables -t filter -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j
ACCEPT
# Allow docker containers to communicate with themselves & outside world
iptables -t filter -A FORWARD -i docker0 ! -o docker0 -j ACCEPT
iptables -t filter -A FORWARD -i docker0 -o docker0 -j ACCEPT
echo "[DOCKER] Done."
Note: This config also prevents you from basic DDOS attack.
answered Dec 7, 2018 at 3:40
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
When I try to run this command, I run into the error:
iptables: No chain/target/match by that name
My iptables version is v1.4.14.
Running debain on linux kernel 3.8.11.
iptables -L outputs:
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
NFQUEUE udp -- anywhere anywhere NFQUEUE num 10000
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy DROP)
target prot opt source destination
NFQUEUE udp -- anywhere 239.255.255.250 udp dpt:1900 NFQUEUE num 10001
ACCEPT all -- anywhere anywhere ctstate NEW,RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
iptables -t nat -L output:
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
I have no clue what the problem is, and I looked and nobody else has had this error with this setup.
Well even after restart it is healthy. You had to check it before restart (I assume the chain
f2b-pam-genericwere not exist). The question is who has deleted it — I don’t know, right now.
I see it happened on another server:
2019-01-30 04:43:48,132 fail2ban.utils [8411]: #39-Lev. 7f5a44dbf168 -- exec: iptables -n -L INPUT | grep -q 'f2b-recidive[ t]'
2019-01-30 04:43:48,132 fail2ban.utils [8411]: ERROR 7f5a44dbf168 -- returned 1
2019-01-30 04:43:48,132 fail2ban.CommandAction [8411]: ERROR Invariant check failed. Trying to restore a sane environment
2019-01-30 04:43:48,144 fail2ban.utils [8411]: #39-Lev. 7f5a442b6540 -- exec: iptables -D INPUT -p tcp -j f2b-recidive
iptables -F f2b-recidive
iptables -X f2b-recidive
2019-01-30 04:43:48,145 fail2ban.utils [8411]: ERROR 7f5a442b6540 -- stderr: "iptables v1.8.0 (legacy): Couldn't load target `f2b-recidive':No such file or directory"
2019-01-30 04:43:48,145 fail2ban.utils [8411]: ERROR 7f5a442b6540 -- stderr: ''
2019-01-30 04:43:48,145 fail2ban.utils [8411]: ERROR 7f5a442b6540 -- stderr: "Try `iptables -h' or 'iptables --help' for more information."
2019-01-30 04:43:48,145 fail2ban.utils [8411]: ERROR 7f5a442b6540 -- stderr: 'iptables: No chain/target/match by that name.'
2019-01-30 04:43:48,145 fail2ban.utils [8411]: ERROR 7f5a442b6540 -- stderr: 'iptables: No chain/target/match by that name.'
2019-01-30 04:43:48,145 fail2ban.utils [8411]: ERROR 7f5a442b6540 -- returned 1
2019-01-30 04:43:48,152 fail2ban.utils [8411]: #39-Lev. 7f5a44dbf168 -- exec: iptables -n -L INPUT | grep -q 'f2b-recidive[ t]'
2019-01-30 04:43:48,153 fail2ban.utils [8411]: ERROR 7f5a44dbf168 -- returned 1
2019-01-30 04:43:48,153 fail2ban.CommandAction [8411]: CRITICAL Unable to restore environment
2019-01-30 04:43:48,153 fail2ban.actions [8411]: ERROR Failed to execute ban jail 'recidive' action 'iptables-allports' info 'ActionInfo({'ip': '192.144.156.187', 'family': 'inet4', 'fid': <function Actions.ActionInfo.<lambda> at 0x7f5a4449f730>, 'raw-ticket': <function Actions.ActionInfo.<lambda> at 0x7f5a4449fc80>})': Error banning 192.144.156.187
These 2 commands ran without a response:
iptables -n -L INPUT | grep -q 'f2b-recidive[ t]'
iptables -D INPUT -p tcp -j f2b-recidive
Anything helpful here from an iptables -L?
Chain INPUT (policy ACCEPT)
target prot opt source destination
f2b-sshd tcp -- anywhere anywhere multiport dports ssh
f2b-pam-generic tcp -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
INPUT_direct all -- anywhere anywhere
INPUT_ZONES_SOURCE all -- anywhere anywhere
INPUT_ZONES all -- anywhere anywhere
DROP all -- anywhere anywhere ctstate INVALID
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
FORWARD_direct all -- anywhere anywhere
FORWARD_IN_ZONES_SOURCE all -- anywhere anywhere
FORWARD_IN_ZONES all -- anywhere anywhere
FORWARD_OUT_ZONES_SOURCE all -- anywhere anywhere
FORWARD_OUT_ZONES all -- anywhere anywhere
DROP all -- anywhere anywhere ctstate INVALID
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
OUTPUT_direct all -- anywhere anywhere
Chain FORWARD_IN_ZONES (1 references)
target prot opt source destination
FWDI_FedoraServer all -- anywhere anywhere [goto]
FWDI_FedoraServer all -- anywhere anywhere [goto]
Chain FORWARD_IN_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_OUT_ZONES (1 references)
target prot opt source destination
FWDO_FedoraServer all -- anywhere anywhere [goto]
FWDO_FedoraServer all -- anywhere anywhere [goto]
Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_direct (1 references)
target prot opt source destination
Chain FWDI_FedoraServer (2 references)
target prot opt source destination
FWDI_FedoraServer_log all -- anywhere anywhere
FWDI_FedoraServer_deny all -- anywhere anywhere
FWDI_FedoraServer_allow all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
Chain FWDI_FedoraServer_allow (1 references)
target prot opt source destination
Chain FWDI_FedoraServer_deny (1 references)
target prot opt source destination
Chain FWDI_FedoraServer_log (1 references)
target prot opt source destination
Chain FWDO_FedoraServer (2 references)
target prot opt source destination
FWDO_FedoraServer_log all -- anywhere anywhere
FWDO_FedoraServer_deny all -- anywhere anywhere
FWDO_FedoraServer_allow all -- anywhere anywhere
Chain FWDO_FedoraServer_allow (1 references)
target prot opt source destination
Chain FWDO_FedoraServer_deny (1 references)
target prot opt source destination
Chain FWDO_FedoraServer_log (1 references)
target prot opt source destination
Chain INPUT_ZONES (1 references)
target prot opt source destination
IN_FedoraServer all -- anywhere anywhere [goto]
IN_FedoraServer all -- anywhere anywhere [goto]
Chain INPUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain INPUT_direct (1 references)
target prot opt source destination
Chain IN_FedoraServer (2 references)
target prot opt source destination
IN_FedoraServer_log all -- anywhere anywhere
IN_FedoraServer_deny all -- anywhere anywhere
IN_FedoraServer_allow all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
Chain IN_FedoraServer_allow (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:websm ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:nfs ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:mountd ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:mountd ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:sunrpc ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:sunrpc ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:http ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:https ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:ipp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:ipp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:sunrpc ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:58498 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:33419 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:834 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:838 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:840 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:843 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:40006 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:40006 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:40995 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:intu-ec-svcdisc ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:intu-ec-svcdisc ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:http ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:https ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:sunrpc ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:892 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:892 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:rquotad ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:rquotad ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:pftp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:pftp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:filenet-rpc ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:32803 ctstate NEW,UNTRACKED
Chain IN_FedoraServer_deny (1 references)
target prot opt source destination
Chain IN_FedoraServer_log (1 references)
target prot opt source destination
Chain OUTPUT_direct (1 references)
target prot opt source destination
Chain f2b-pam-generic (1 references)
target prot opt source destination
REJECT all -- 218.92.1.130 anywhere reject-with icmp-port-unreachable
REJECT all -- 188.131.179.44 anywhere reject-with icmp-port-unreachable
REJECT all -- 106.248.51.54 anywhere reject-with icmp-port-unreachable
REJECT all -- 161.132.195.76 anywhere reject-with icmp-port-unreachable
REJECT all -- broadband.actcorp.in anywhere reject-with icmp-port-unreachable
REJECT all -- prospectos-ubuntu-16.04 anywhere reject-with icmp-port-unreachable
REJECT all -- 157.ip-54-37-69.eu anywhere reject-with icmp-port-unreachable
REJECT all -- 189.115.221.77.static.gvt.net.br anywhere reject-with icmp-port-unreachable
REJECT all -- 159.89.115.126 anywhere reject-with icmp-port-unreachable
REJECT all -- 112.175.39.160 anywhere reject-with icmp-port-unreachable
REJECT all -- 22.193.46.186.static.anycast.cnt-grms.ec anywhere reject-with icmp-port-unreachable
REJECT all -- 192.241.159.27 anywhere reject-with icmp-port-unreachable
REJECT all -- dynamic-ip-1868417225.cable.net.co anywhere reject-with icmp-port-unreachable
REJECT all -- 235.ip-54-37-139.eu anywhere reject-with icmp-port-unreachable
REJECT all -- 125.134.251.45 anywhere reject-with icmp-port-unreachable
REJECT all -- static-dsl-199.87-197-135.telecom.sk anywhere reject-with icmp-port-unreachable
REJECT all -- 178.128.13.21 anywhere reject-with icmp-port-unreachable
REJECT all -- 98.ip-149-56-15.net anywhere reject-with icmp-port-unreachable
REJECT all -- host81-136-241-89.in-addr.btopenworld.com anywhere reject-with icmp-port-unreachable
RETURN all -- anywhere anywhere
Chain f2b-recidive (0 references)
target prot opt source destination
REJECT all -- 155.ip-37-59-98.eu anywhere reject-with icmp-port-unreachable
REJECT all -- mail.arlencreate.com-bad anywhere reject-with icmp-port-unreachable
REJECT all -- 118.24.78.202 anywhere reject-with icmp-port-unreachable
RETURN all -- anywhere anywhere
Chain f2b-sshd (1 references)
target prot opt source destination
REJECT all -- 188.131.179.44 anywhere reject-with icmp-port-unreachable
REJECT all -- 106.248.51.54 anywhere reject-with icmp-port-unreachable
REJECT all -- 161.132.195.76 anywhere reject-with icmp-port-unreachable
REJECT all -- broadband.actcorp.in anywhere reject-with icmp-port-unreachable
REJECT all -- prospectos-ubuntu-16.04 anywhere reject-with icmp-port-unreachable
REJECT all -- 157.ip-54-37-69.eu anywhere reject-with icmp-port-unreachable
REJECT all -- 189.115.221.77.static.gvt.net.br anywhere reject-with icmp-port-unreachable
REJECT all -- 159.89.115.126 anywhere reject-with icmp-port-unreachable
REJECT all -- 22.193.46.186.static.anycast.cnt-grms.ec anywhere reject-with icmp-port-unreachable
REJECT all -- 192.241.159.27 anywhere reject-with icmp-port-unreachable
REJECT all -- dynamic-ip-1868417225.cable.net.co anywhere reject-with icmp-port-unreachable
REJECT all -- 235.ip-54-37-139.eu anywhere reject-with icmp-port-unreachable
REJECT all -- 125.134.251.45 anywhere reject-with icmp-port-unreachable
REJECT all -- static-dsl-199.87-197-135.telecom.sk anywhere reject-with icmp-port-unreachable
REJECT all -- 98.ip-149-56-15.net anywhere reject-with icmp-port-unreachable
REJECT all -- host81-136-241-89.in-addr.btopenworld.com anywhere reject-with icmp-port-unreachable
RETURN all -- anywhere anywhere
[root@erdos ~]# less /var/log/fail2ban.log
[root@erdos ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
f2b-sshd tcp -- anywhere anywhere multiport dports ssh
f2b-pam-generic tcp -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
INPUT_direct all -- anywhere anywhere
INPUT_ZONES_SOURCE all -- anywhere anywhere
INPUT_ZONES all -- anywhere anywhere
DROP all -- anywhere anywhere ctstate INVALID
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
FORWARD_direct all -- anywhere anywhere
FORWARD_IN_ZONES_SOURCE all -- anywhere anywhere
FORWARD_IN_ZONES all -- anywhere anywhere
FORWARD_OUT_ZONES_SOURCE all -- anywhere anywhere
FORWARD_OUT_ZONES all -- anywhere anywhere
DROP all -- anywhere anywhere ctstate INVALID
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
OUTPUT_direct all -- anywhere anywhere
Chain FORWARD_IN_ZONES (1 references)
target prot opt source destination
FWDI_FedoraServer all -- anywhere anywhere [goto]
FWDI_FedoraServer all -- anywhere anywhere [goto]
Chain FORWARD_IN_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_OUT_ZONES (1 references)
target prot opt source destination
FWDO_FedoraServer all -- anywhere anywhere [goto]
FWDO_FedoraServer all -- anywhere anywhere [goto]
Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_direct (1 references)
target prot opt source destination
Chain FWDI_FedoraServer (2 references)
target prot opt source destination
FWDI_FedoraServer_log all -- anywhere anywhere
FWDI_FedoraServer_deny all -- anywhere anywhere
FWDI_FedoraServer_allow all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
Chain FWDI_FedoraServer_allow (1 references)
target prot opt source destination
Chain FWDI_FedoraServer_deny (1 references)
target prot opt source destination
Chain FWDI_FedoraServer_log (1 references)
target prot opt source destination
Chain FWDO_FedoraServer (2 references)
target prot opt source destination
FWDO_FedoraServer_log all -- anywhere anywhere
FWDO_FedoraServer_deny all -- anywhere anywhere
FWDO_FedoraServer_allow all -- anywhere anywhere
Chain FWDO_FedoraServer_allow (1 references)
target prot opt source destination
Chain FWDO_FedoraServer_deny (1 references)
target prot opt source destination
Chain FWDO_FedoraServer_log (1 references)
target prot opt source destination
Chain INPUT_ZONES (1 references)
target prot opt source destination
IN_FedoraServer all -- anywhere anywhere [goto]
IN_FedoraServer all -- anywhere anywhere [goto]
Chain INPUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain INPUT_direct (1 references)
target prot opt source destination
Chain IN_FedoraServer (2 references)
target prot opt source destination
IN_FedoraServer_log all -- anywhere anywhere
IN_FedoraServer_deny all -- anywhere anywhere
IN_FedoraServer_allow all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
Chain IN_FedoraServer_allow (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:websm ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:nfs ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:mountd ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:mountd ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:sunrpc ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:sunrpc ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:http ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:https ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:ipp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:ipp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:sunrpc ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:58498 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:33419 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:834 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:838 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:840 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:843 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:40006 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:40006 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:40995 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:intu-ec-svcdisc ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:intu-ec-svcdisc ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:http ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:https ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:sunrpc ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:892 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:892 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:rquotad ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:rquotad ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:pftp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:pftp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:filenet-rpc ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:32803 ctstate NEW,UNTRACKED
Chain IN_FedoraServer_deny (1 references)
target prot opt source destination
Chain IN_FedoraServer_log (1 references)
target prot opt source destination
Chain OUTPUT_direct (1 references)
target prot opt source destination
Chain f2b-pam-generic (1 references)
target prot opt source destination
REJECT all -- 218.92.1.130 anywhere reject-with icmp-port-unreachable
REJECT all -- 188.131.179.44 anywhere reject-with icmp-port-unreachable
REJECT all -- 106.248.51.54 anywhere reject-with icmp-port-unreachable
REJECT all -- 161.132.195.76 anywhere reject-with icmp-port-unreachable
REJECT all -- broadband.actcorp.in anywhere reject-with icmp-port-unreachable
REJECT all -- prospectos-ubuntu-16.04 anywhere reject-with icmp-port-unreachable
REJECT all -- 157.ip-54-37-69.eu anywhere reject-with icmp-port-unreachable
REJECT all -- 189.115.221.77.static.gvt.net.br anywhere reject-with icmp-port-unreachable
REJECT all -- 159.89.115.126 anywhere reject-with icmp-port-unreachable
REJECT all -- 112.175.39.160 anywhere reject-with icmp-port-unreachable
REJECT all -- 22.193.46.186.static.anycast.cnt-grms.ec anywhere reject-with icmp-port-unreachable
REJECT all -- 192.241.159.27 anywhere reject-with icmp-port-unreachable
REJECT all -- dynamic-ip-1868417225.cable.net.co anywhere reject-with icmp-port-unreachable
REJECT all -- 235.ip-54-37-139.eu anywhere reject-with icmp-port-unreachable
REJECT all -- 125.134.251.45 anywhere reject-with icmp-port-unreachable
REJECT all -- static-dsl-199.87-197-135.telecom.sk anywhere reject-with icmp-port-unreachable
REJECT all -- 178.128.13.21 anywhere reject-with icmp-port-unreachable
REJECT all -- 98.ip-149-56-15.net anywhere reject-with icmp-port-unreachable
REJECT all -- host81-136-241-89.in-addr.btopenworld.com anywhere reject-with icmp-port-unreachable
RETURN all -- anywhere anywhere
Chain f2b-recidive (0 references)
target prot opt source destination
REJECT all -- 155.ip-37-59-98.eu anywhere reject-with icmp-port-unreachable
REJECT all -- mail.arlencreate.com-bad anywhere reject-with icmp-port-unreachable
REJECT all -- 118.24.78.202 anywhere reject-with icmp-port-unreachable
RETURN all -- anywhere anywhere
Chain f2b-sshd (1 references)
target prot opt source destination
REJECT all -- 188.131.179.44 anywhere reject-with icmp-port-unreachable
REJECT all -- 106.248.51.54 anywhere reject-with icmp-port-unreachable
REJECT all -- 161.132.195.76 anywhere reject-with icmp-port-unreachable
REJECT all -- broadband.actcorp.in anywhere reject-with icmp-port-unreachable
REJECT all -- prospectos-ubuntu-16.04 anywhere reject-with icmp-port-unreachable
REJECT all -- 157.ip-54-37-69.eu anywhere reject-with icmp-port-unreachable
REJECT all -- 189.115.221.77.static.gvt.net.br anywhere reject-with icmp-port-unreachable
REJECT all -- 159.89.115.126 anywhere reject-with icmp-port-unreachable
REJECT all -- 22.193.46.186.static.anycast.cnt-grms.ec anywhere reject-with icmp-port-unreachable
REJECT all -- 192.241.159.27 anywhere reject-with icmp-port-unreachable
REJECT all -- dynamic-ip-1868417225.cable.net.co anywhere reject-with icmp-port-unreachable
REJECT all -- 235.ip-54-37-139.eu anywhere reject-with icmp-port-unreachable
REJECT all -- 125.134.251.45 anywhere reject-with icmp-port-unreachable
REJECT all -- static-dsl-199.87-197-135.telecom.sk anywhere reject-with icmp-port-unreachable
REJECT all -- 98.ip-149-56-15.net anywhere reject-with icmp-port-unreachable
REJECT all -- host81-136-241-89.in-addr.btopenworld.com anywhere reject-with icmp-port-unreachable
RETURN all -- anywhere anywhere
[root@erdos ~]# less /var/log/messages
[root@erdos ~]# less /var/log/dnf.l
/var/log/dnf.l: No such file or directory
[root@erdos ~]# less /var/log/dnf.log
[root@erdos ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
f2b-sshd tcp -- anywhere anywhere multiport dports ssh
f2b-pam-generic tcp -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
INPUT_direct all -- anywhere anywhere
INPUT_ZONES_SOURCE all -- anywhere anywhere
INPUT_ZONES all -- anywhere anywhere
DROP all -- anywhere anywhere ctstate INVALID
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
FORWARD_direct all -- anywhere anywhere
FORWARD_IN_ZONES_SOURCE all -- anywhere anywhere
FORWARD_IN_ZONES all -- anywhere anywhere
FORWARD_OUT_ZONES_SOURCE all -- anywhere anywhere
FORWARD_OUT_ZONES all -- anywhere anywhere
DROP all -- anywhere anywhere ctstate INVALID
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
OUTPUT_direct all -- anywhere anywhere
Chain FORWARD_IN_ZONES (1 references)
target prot opt source destination
FWDI_FedoraServer all -- anywhere anywhere [goto]
FWDI_FedoraServer all -- anywhere anywhere [goto]
Chain FORWARD_IN_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_OUT_ZONES (1 references)
target prot opt source destination
FWDO_FedoraServer all -- anywhere anywhere [goto]
FWDO_FedoraServer all -- anywhere anywhere [goto]
Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_direct (1 references)
target prot opt source destination
Chain FWDI_FedoraServer (2 references)
target prot opt source destination
FWDI_FedoraServer_log all -- anywhere anywhere
FWDI_FedoraServer_deny all -- anywhere anywhere
FWDI_FedoraServer_allow all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
Chain FWDI_FedoraServer_allow (1 references)
target prot opt source destination
Chain FWDI_FedoraServer_deny (1 references)
target prot opt source destination
Chain FWDI_FedoraServer_log (1 references)
target prot opt source destination
Chain FWDO_FedoraServer (2 references)
target prot opt source destination
FWDO_FedoraServer_log all -- anywhere anywhere
FWDO_FedoraServer_deny all -- anywhere anywhere
FWDO_FedoraServer_allow all -- anywhere anywhere
Chain FWDO_FedoraServer_allow (1 references)
target prot opt source destination
Chain FWDO_FedoraServer_deny (1 references)
target prot opt source destination
Chain FWDO_FedoraServer_log (1 references)
target prot opt source destination
Chain INPUT_ZONES (1 references)
target prot opt source destination
IN_FedoraServer all -- anywhere anywhere [goto]
IN_FedoraServer all -- anywhere anywhere [goto]
Chain INPUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain INPUT_direct (1 references)
target prot opt source destination
Chain IN_FedoraServer (2 references)
target prot opt source destination
IN_FedoraServer_log all -- anywhere anywhere
IN_FedoraServer_deny all -- anywhere anywhere
IN_FedoraServer_allow all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
Chain IN_FedoraServer_allow (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:websm ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:nfs ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:mountd ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:mountd ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:sunrpc ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:sunrpc ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:http ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:https ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:ipp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:ipp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:sunrpc ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:58498 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:33419 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:834 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:838 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:840 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:843 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:40006 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:40006 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:40995 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:intu-ec-svcdisc ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:intu-ec-svcdisc ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:http ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:https ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:sunrpc ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:892 ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:892 ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:rquotad ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:rquotad ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:pftp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:pftp ctstate NEW,UNTRACKED
ACCEPT udp -- anywhere anywhere udp dpt:filenet-rpc ctstate NEW,UNTRACKED
ACCEPT tcp -- anywhere anywhere tcp dpt:32803 ctstate NEW,UNTRACKED
Chain IN_FedoraServer_deny (1 references)
target prot opt source destination
Chain IN_FedoraServer_log (1 references)
target prot opt source destination
Chain OUTPUT_direct (1 references)
target prot opt source destination
Chain f2b-pam-generic (1 references)
target prot opt source destination
REJECT all -- 123.206.207.66 anywhere reject-with icmp-port-unreachable
REJECT all -- 218.92.1.130 anywhere reject-with icmp-port-unreachable
REJECT all -- 188.131.179.44 anywhere reject-with icmp-port-unreachable
REJECT all -- 106.248.51.54 anywhere reject-with icmp-port-unreachable
REJECT all -- 161.132.195.76 anywhere reject-with icmp-port-unreachable
REJECT all -- broadband.actcorp.in anywhere reject-with icmp-port-unreachable
REJECT all -- prospectos-ubuntu-16.04 anywhere reject-with icmp-port-unreachable
REJECT all -- 157.ip-54-37-69.eu anywhere reject-with icmp-port-unreachable
REJECT all -- 189.115.221.77.static.gvt.net.br anywhere reject-with icmp-port-unreachable
REJECT all -- 159.89.115.126 anywhere reject-with icmp-port-unreachable
REJECT all -- 112.175.39.160 anywhere reject-with icmp-port-unreachable
REJECT all -- 22.193.46.186.static.anycast.cnt-grms.ec anywhere reject-with icmp-port-unreachable
REJECT all -- 192.241.159.27 anywhere reject-with icmp-port-unreachable
REJECT all -- dynamic-ip-1868417225.cable.net.co anywhere reject-with icmp-port-unreachable
REJECT all -- 235.ip-54-37-139.eu anywhere reject-with icmp-port-unreachable
REJECT all -- 125.134.251.45 anywhere reject-with icmp-port-unreachable
REJECT all -- static-dsl-199.87-197-135.telecom.sk anywhere reject-with icmp-port-unreachable
REJECT all -- 178.128.13.21 anywhere reject-with icmp-port-unreachable
REJECT all -- 98.ip-149-56-15.net anywhere reject-with icmp-port-unreachable
RETURN all -- anywhere anywhere
Chain f2b-recidive (0 references)
target prot opt source destination
REJECT all -- 155.ip-37-59-98.eu anywhere reject-with icmp-port-unreachable
REJECT all -- mail.arlencreate.com-bad anywhere reject-with icmp-port-unreachable
REJECT all -- 118.24.78.202 anywhere reject-with icmp-port-unreachable
RETURN all -- anywhere anywhere
Chain f2b-sshd (1 references)
target prot opt source destination
REJECT all -- 123.206.207.66 anywhere reject-with icmp-port-unreachable
REJECT all -- 188.131.179.44 anywhere reject-with icmp-port-unreachable
REJECT all -- 106.248.51.54 anywhere reject-with icmp-port-unreachable
REJECT all -- 161.132.195.76 anywhere reject-with icmp-port-unreachable
REJECT all -- broadband.actcorp.in anywhere reject-with icmp-port-unreachable
REJECT all -- prospectos-ubuntu-16.04 anywhere reject-with icmp-port-unreachable
REJECT all -- 157.ip-54-37-69.eu anywhere reject-with icmp-port-unreachable
REJECT all -- 189.115.221.77.static.gvt.net.br anywhere reject-with icmp-port-unreachable
REJECT all -- 159.89.115.126 anywhere reject-with icmp-port-unreachable
REJECT all -- 22.193.46.186.static.anycast.cnt-grms.ec anywhere reject-with icmp-port-unreachable
REJECT all -- 192.241.159.27 anywhere reject-with icmp-port-unreachable
REJECT all -- dynamic-ip-1868417225.cable.net.co anywhere reject-with icmp-port-unreachable
REJECT all -- 235.ip-54-37-139.eu anywhere reject-with icmp-port-unreachable
REJECT all -- 125.134.251.45 anywhere reject-with icmp-port-unreachable
REJECT all -- static-dsl-199.87-197-135.telecom.sk anywhere reject-with icmp-port-unreachable
REJECT all -- 98.ip-149-56-15.net anywhere reject-with icmp-port-unreachable
RETURN all -- anywhere anywhere
Автор aveia, 11 июля 2016, 16:17:09
« назад — далее »
0 Пользователи и 1 гость просматривают эту тему.
Доброго времени суток! Вынужден обратиться за помощью, так как проблема лежит в области от которой я пока далек. Пришел к данной ошибке решая другие проблемы.
И так:
debian 8
# uname -a
Linux armsrv 2.6.32-042stab116.1 #1 SMP Wed May 4 16:21:02 MSK 2016 x86_64 GNU/Linux
при попытке добавления в iptables
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
получаю
iptables: No chain/target/match by that name.
при иследовании гугла родилась догадка, что не хватает модулей, но как понять каких, где их взять и куда прикрутить к сожалению пока не знаю, если не затруднит прошу помочь
Debian 7, все работает
$ipt -A INPUT -p all -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPTпросто укажите протокол.
Цитата: gardarea51 от 11 июля 2016, 18:04:34Debian 7, все работает
Код: [Выделить]
$ipt -A INPUT -p all -m conntrack —ctstate ESTABLISHED,RELATED -j ACCEPT
просто укажите протокол.
то что в принципе работает я не сомневаюсь), я вот и хочу разобраться почему у меня не работает и как это победить
# iptables -A INPUT -p all -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables: No chain/target/match by that name.
Хмм… дайте вывод
iptables -L -n
вот пожелуйста, без указанной строки у меня не работают соединения(даже пинг не пашет)
Chain INPUT (policy DROP)
target prot opt source destination
fail2ban-VESTA tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8083
fail2ban-MAIL tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,587,2525,110,995,143,993
fail2ban-SSH tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
ACCEPT all -- тут-ИП-сервера 0.0.0.0/0
ACCEPT all -- 127.0.0.1 0.0.0.0/0
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 21,12000:12100
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,587,2525
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 110,995
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 143,993
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 3306,5432
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8083
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain fail2ban-MAIL (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-SSH (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-VESTA (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-ssh (0 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain vesta (0 references)
target prot opt source destination
А попробуйте тогда по старому:
-m state --state ESTABLISHED,RELATED -j ACCEPT
root@armsrv:~# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables: No chain/target/match by that name.
всетаки мне кажется раз ошибка при использовании -m то дело в модулях
Страаааннооо…
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 110,995
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 143,993
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 3306,5432
тут же модуль multiport прекрасно работает..
Ну попробуйте ему прямо явно указать какую таблицу использовать
iptables -t filter -A INPUT -p all -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
И попробуйте подгрузить модуль
modprobe ip_conntrack
бяда какая-то! 
#modprobe ip_conntrack
modprobe: ERROR: ../libkmod/libkmod.c:508 kmod_lookup_alias_from_builtin_file() could not open builtin file '/lib/modules/2.6.32-042stab116.1/modules.builtin.bin'
modprobe: FATAL: Module ip_conntrack not found.
более того
# modprobe x_tables
modprobe: ERROR: ../libkmod/libkmod.c:508 kmod_lookup_alias_from_builtin_file() could not open builtin file '/lib/modules/2.6.32-042stab116.1/modules.builtin.bin'
modprobe: FATAL: Module x_tables not found.
и тоже самое с ip_conntrack_netbios_ns ipt_conntrack ipt_LOG ipt_owner ipt_state ip_conntrack_ftp iptable_nat ip_nat_ftp ip_tables ipt_multiport iptable_filter ipt_limit
а вот что с этим делать я не в курсе, в первом посте писал
Цитироватьпри иследовании гугла родилась догадка, что не хватает модулей, но как понять каких, где их взять и куда прикрутить к сожалению пока не знаю, если не затруднит прошу помочь
нет, какое хостер дал, это vps-ка 
OpenVZ, спасибо за ссылки, но я так понял что сделать ничего нельзя, придется менять хостера
Cообщение объединено 14 июля 2016, 16:35:44
найти бы конфиг который работал бы у этого провайдера
Самое первое, что мне кажется нужно сделать — написать провайдеру.
А вдруг пойдут на встречу.
Cообщение объединено 14 июля 2016, 20:39:36
То есть хостеру )
после долгово общения поддержка остановилась на позиции » все необходимые модули для работы присутствуют»
- Русскоязычное сообщество Debian GNU/Linux
-
►
-
►
Администрирование -
►
iptabeles — No chain/target/match by that name.