I have /etc/iptables/rule.v4 file contains many rule, the below is the line where I see the issue

-A INPUT -p tcp -m multiport --dports 22 -j ACCEPT
-A INPUT -p udp -m multiport --dports 16384:32768 -j ACCEPT

When I tried to do iptables-restore it failed with below error

root@rs-dal:/etc/iptables# iptables-restore rules.q
iptables-restore v1.8.2 (nf_tables): multiport needs `-p tcp', `-p udp', `-p udplite', `-p sctp' or `-p dccp'
Error occurred at line: 26
Try `iptables-restore -h' or 'iptables-restore --help' for more information.

why is it failing?, the same rule had worked successfully on Debian Jessie.

Also when I changed the rules like below, it worked.

-A INPUT -p tcp --dport 22 -j ACCEPT
-A INPUT -p udp --dport 16384:32768 -j ACCEPT

I checked the iptables -L and these rules applied successfully as below

ACCEPT     udp  --  anywhere             anywhere             udp dpts:16384:32768
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh

Whether the rule that I currently have is a valid syntax?

Below is my OS details

root@rs-dal:/etc/iptables# cat /etc/os-release 
PRETTY_NAME="Debian GNU/Linux buster/sid"
NAME="Debian GNU/Linux"
  • Is the line you are talking about the offending line? Line 26? – kemotep Mar 22 at 15:42
  • yes the line 26 is -A INPUT -p tcp -m multiport --dports 22 -j ACCEPT – Karthik Mar 22 at 15:44
  • Are you saving the rules via iptables-save > rules.q and restoring with iptables-restore < rules.q? I just tested with your exact rules on Debian 9. – kemotep Mar 22 at 15:53
  • 1
    Can you manually add that rule? Removing that rule from your save file, manually adding it, saving the file again and seeing if it can be restored again. – kemotep Mar 22 at 18:02
  • 2
    There's the difference on buster/sid: iptables is running over nftables, as seen in your version: iptables-restore v1.8.2 (nf_tables) . If you can reproduce a file made from an iptables-*-save, not manually, where using iptables-legacy-restore works but not iptables-nft-restore, that might be a parsing bug. – A.B Mar 22 at 20:01

As user A.B. points out there is an issue with incompatibility between nftables, which Buster uses, and iptables. The best way to save iptables rules to be restored with iptables-restore between compatible versions.

Remove the offending line, and restore the rules:

iptables-restore < rules.q

Re-add the rule to your configuration and save:

iptables -A INPUT -p tcp -m multiport --dports 22 -j ACCEPT
iptables-save > rules.q

Now try restoring again:

iptables-restore < rules.q

Use iptables -L to verify all of your rules are in place.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.