1

I'm working on an assignment in which I have to create some custom firewall rules on a Debian router. I'm using iptables to create the rules. Here's the thing, whenever I try to add this rule: iptables -A FORWARD -m state --state NEW,ESTABLISHED -m tcp --destination-port 20:443 -s 192.168.2.107 -j ACCEPT I get this error: RULE_APPEND failed (Invalid argument): rule in chain FORWARD, I've been trying to solve this problem for like 5 hours now and can't get around it, can someone help me figure out what's wrong? Thanks!

1 Answer 1

1

The reason is that the iptables match module tcp is expecting to be called for the tcp protocol case only, selected with the -p tcp option, but it wasn't. This mistake is rarely happening, because usually only -p tcp is written, which automatically loads the -m tcp match module.

This can be seen with this kernel's dmesg line:

 x_tables: ip_tables: tcp match: only valid for protocol 6

where protocol 6 means tcp (as can be found in /etc/protocols). This message triggers both with iptables-nft (that you are using) and iptables-legacy because even the nft version uses the kernel xtables module (xt_tcpudp.ko). The legacy version's error message would have been more helpful with:

iptables: Invalid argument. Run `dmesg' for more information.

So to fix your rule, that would be:

iptables -A FORWARD -m state --state NEW,ESTABLISHED -p tcp -m tcp --destination-port 20:443 -s 192.168.2.107 -j ACCEPT

and actually the -m tcp is optional (and also the obsolete -m state --state can be replaced with superseding -m conntrack --ctstate).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .