I'm working on an assignment in which I have to create some custom firewall rules on a Debian router. I'm using iptables to create the rules. Here's the thing, whenever I try to add this rule: iptables -A FORWARD -m state --state NEW,ESTABLISHED -m tcp --destination-port 20:443 -s 192.168.2.107 -j ACCEPT
I get this error: RULE_APPEND failed (Invalid argument): rule in chain FORWARD
, I've been trying to solve this problem for like 5 hours now and can't get around it, can someone help me figure out what's wrong? Thanks!
1 Answer
The reason is that the iptables match module tcp is expecting to be called for the tcp protocol case only, selected with the -p tcp
option, but it wasn't. This mistake is rarely happening, because usually only -p tcp
is written, which automatically loads the -m tcp
match module.
This can be seen with this kernel's dmesg
line:
x_tables: ip_tables: tcp match: only valid for protocol 6
where protocol 6 means tcp (as can be found in /etc/protocols
). This message triggers both with iptables-nft (that you are using) and iptables-legacy because even the nft version uses the kernel xtables module (xt_tcpudp.ko
). The legacy version's error message would have been more helpful with:
iptables: Invalid argument. Run `dmesg' for more information.
So to fix your rule, that would be:
iptables -A FORWARD -m state --state NEW,ESTABLISHED -p tcp -m tcp --destination-port 20:443 -s 192.168.2.107 -j ACCEPT
and actually the -m tcp
is optional (and also the obsolete -m state --state
can be replaced with superseding -m conntrack --ctstate
).