0

In the past, I have used the following script to set up a stateful firewall (on a normal x64 Ubuntu machine) without issue:

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -N TCP
iptables -N UDP
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A INPUT -i wlan0 -j ACCEPT
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A INPUT -p icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
iptables -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
iptables -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-rst
iptables -A INPUT -j REJECT --reject-with icmp-proto-unreachable
iptables -A TCP -p tcp --dport 22 -j ACCEPT

I am trying to accomplish the same on an am335x Starter Kit board, running the standard SDK 6 image. As such it runs TI's Arago OS.

It fails on the lines involving '-m conntrack' with:

iptables: No chain/target/match by that name.

The output of 'iptables -S' is:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

I tried 'modprobe nf_conntrack' to no avail (the command succeeded, but did not help.) I also tried purposefully misspelling parts of the command such as:

iptables -A INPUT -m conntrack --ctstate BLAH -j ACCEPT

gives error: iptables v1.4.15: Bad ctstate "BLAH"

And:

iptables -A INPUT -m conntrack --ctstate RELATED -j BLAH

gives error: iptables v1.4.15: Couldn't load target `BLAH':No such file or directory

So curiously, it seems to indicate it is complaining about the '-A INPUT' portion, which works perfectly fine in other commands such as:

iptables -A INPUT -i lo -j ACCEPT
0

I had posted this question to the TI Forums as well, and got a response.

Enabling CONFIG_NETFILTER_XT_MATCH_CONNTRACK in the kernel config solved this issue. I just set CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y in the config, rebuilt with the SDK (instructions here).

After installing the new kernel and modules, the -m conntrack command doesn't complain anymore.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.