0

I tried to add some rules, but it kept failing.

Here is the rule like:

ipset create FABEDGE-PEER-CIDR hash:net

iptables -t nat -N FABEDGE-NAT-OUTGOING
iptables -t nat -A POSTROUTING -j FABEDGE-NAT-OUTGOING
iptables -t nat -A FABEDGE-NAT-OUTGOING -s 192.168.3.0/24 -m set --match-set FABEDGE-PEER-CIDR dst -j RETURN

Here is the result:

++ iptables -t nat -N FABEDGE-NAT-OUTGOING
iptables: Chain already exists.
++ iptables -t nat -A POSTROUTING -j FABEDGE-NAT-OUTGOING
++ iptables -t nat -A FABEDGE-NAT-OUTGOING -s 192.168.3.0/24 -m set --match-set 
FABEDGE-PEER-CIDR dst -j RETURN
iptables: No chain/target/match by that name.

Everytime this line

iptables -t nat -A FABEDGE-NAT-OUTGOING -s 192.168.3.0/24 -m set --match-set FABEDGE-PEER-CIDR dst -j RETURN

failed with the message: "iptables: No chain/target/match by that name."

I googled about this message, it seems iptables couldn't load ipset match, I checked the file "/proc/net/ip_tables_matches", here is the content:

cat /proc/net/ip_tables_matches
conntrack
conntrack
conntrack
addrtype
udplite
udp
tcp
addrtype
icmp

There should be a at lease one "set" in this file. Some articles mentioned iptables will load match module as required.

I use lsmod | grep ip and found ip_set module is loaded:

 lsmod | grep ip
iptable_raw             2525  0
ip_set_hash_net        33113  1
ip_set                 44480  1 ip_set_hash_net

I really have no idea what should I do, not a single clue.

Any help is welcome, thanks in advance.

I should methon my iptables is v1.6.1, my kernel is 4.9.253-tegra and this kernel is cutomized.

6
  • Can you try without using the customized kernel? Those iptables lines work perfectly on a Centos 7 test system.
    – thrig
    Commented Jul 14, 2022 at 12:25
  • probably a custom kernel without support configured. the missing module would be xt_set (which is the iptables part) rather than ip_set (which is the... ipset part).
    – A.B
    Commented Jul 14, 2022 at 19:15
  • @ thrig those iptables rules works on my other computers too.
    – Jianbo Yan
    Commented Jul 15, 2022 at 3:21
  • @A.B Yeah. I found that. But still I don't known why iptables didn't load xt_set module, I can saw it (xt_set.ko) in /lib/modules/4.9.253-tegra/kernel/net/netfilter/ folder
    – Jianbo Yan
    Commented Jul 15, 2022 at 3:33
  • So can you load it manually with modprobe? Or even more manually with insmod?
    – A.B
    Commented Jul 18, 2022 at 18:47

1 Answer 1

0

It seems this self-compiled kernel missed some IPv6 modules, after my vendor provides another kernel, the problem is gone.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .