Que erro é este? [RESOLVIDO]

escastilho
(usa Ubuntu)

Enviado em 13/09/2008 - 10:42h

Pessoal estou aqui configurando o iptables em um CentOS, estou montando um script e quando vou executá-lo em /usr/local/bin aparece a seguinte mensagem

iptables: No chain/target/match by that name

Alguém, sabe o que pode ser?

Segue o código

IPT=/sbin/iptables
##################
#Políticas gerais#
##################
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t filter -F
$IPT -t nat -F
$IPT -t mangle -F
$IPT -t filter -Z
$IPT -t nat -Z
$IPT -t mangle -Z

##################
#Tabela Filter####
##################
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -s 192.168.XX.X/24 -p icmp -j ACCEPT #LAN
$IPT -A INPUT -s 192.168.XX.X/24 -p tcp -m tcp --dport 22 -j ACCEPT #LAN
$IPT -A INPUT -s 192.168.XX.X/24 -p udp --dport 53 -j ACCEPT #DNS
$IPT -A INPUT -s 192.168.XX.X/24 -p tcp --dport 53 -j ACCEPT #DNS
#$IPT -A INPUT -s 192.168.XX.X/24 -p tcp --dport 3128 -j ACCEPT #Proxy - (LAN)

#$IPT -A FORWARD -s 192.168.XX.X/24 -p tcp -m multiport --dport 80 -j DROP #Bloqueio para proxy

$IPT -A FORWARD -d 192.168.XX.X -p tcp -m tcp --dport 3389 -j ACCEPT
$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 3389 -j ACCEPT
$IPT -A FPRWARD -d 192.168.XX.X -p tcp -m tcp --dport 3389 -j ACCEPT
$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 3389 -j ACCEPT
$IPT -A FORWARD -d 192.168.XX.X -p tcp -m tcp --dport 5900 -j ACCEPT
$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 5900 -j ACCEPT
$IPT -A FORWARD -d 192.168.XX.X -p tcp -m tcp --dport 1521 -j ACCEPT
$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 1521 -j ACCEPT
$IPT -A FORWARD -d 192.168.XX.X -p tcp -m tcp --dport 1630 -j ACCEPT
$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 1630 -j ACCEPT
$IPT -A FORWARD -d 192.168.XX.X -p tcp -m tcp --dport 2610 -j ACCEPT
$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 2610 -j ACCEPT
$IPT -A FORWARD -d 192.168.XX.X -p tcp -m tcp --dport 2483 -j ACCEPT
$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 2484 -j ACCEPT

$IPT -A FORWARD -i eth1 -s 192.168.XX.X/24 -j ACCEPT
$IPT -A FORWARD -o eth1 -m state --state NEW,INVALID -j DROP
$IPT -A FORWARD -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -j DROP
$IPT -A INPUT -j DROP

##################
#Tabela NAT#######
##################
$IPT -t nat -A POSTROUTING -s 192.168.XX.X/24 -o eth0 -j MASQUERADE
#$IPT -t nat -A PREROUTING -s 192.168.XX.X/24 -p tcp --dport 80 -j REDIRECT --to-port 3128 #Proxy Transparente
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 3389 -j DNAT --to 192.168.XX.X:3389
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 3389 -j DNAT --to 192.168.XX.X:3389
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 5900 -j DNAT --to 192.168.XX.X:5900
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 1521 -j DNAT --to 192.168.XX.X:1521
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 1630 -j DNAT --to 192.168.XX.X:1630
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 2610 -j DNAT --to 192.168.XX.X:2610
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 2483 -j DNAT --to 192.168.XX.X:2483
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 2484 -j DNAT --to 192.168.XX.X:2484
#$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 1630 -j DNAT --to 192.168.XX.X:1630

Att.
Erik

krun
(usa Debian)

Enviado em 16/09/2008 - 11:22h

amigo não tem necessidade de voce declarar o "mangle" se vc nem vai usa-lo, ele é necessario para fazer marcação de pacotes para fazer balanceamento de carga de forma avançada....mais vou ver o que eu posso fazer por vc para encontrarr esse problema.

krun
(usa Debian)

Enviado em 16/09/2008 - 11:30h

Segue o código

IPT=/sbin/iptables
##################
#Políticas gerais#
##################
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t filter -F
$IPT -t nat -F
$IPT -t mangle -F
$IPT -t filter -Z
$IPT -t nat -Z
$IPT -t mangle -Z

##################
#Tabela Filter####
##################
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -s 192.168.XX.X/24 -p icmp -j ACCEPT #LAN
$IPT -A INPUT -s 192.168.XX.X/24 -p tcp -m tcp --dport 22 -j ACCEPT #LAN
$IPT -A INPUT -s 192.168.XX.X/24 -p udp --dport 53 -j ACCEPT #DNS
$IPT -A INPUT -s 192.168.XX.X/24 -p tcp --dport 53 -j ACCEPT #DNS
#$IPT -A INPUT -s 192.168.XX.X/24 -p tcp --dport 3128 -j ACCEPT #Proxy - (LAN)

#$IPT -A FORWARD -s 192.168.XX.X/24 -p tcp -m multiport --dport 80 -j DROP #Bloqueio para proxy

$IPT -A FORWARD -d 192.168.XX.X -p tcp -m tcp --dport 3389 -j ACCEPT
$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 3389 -j ACCEPT
#################################################################
################# A CHAIN FORWARD TA ERRADA NESSA LINHA #########
#################################################################

$IPT -A FPRWARD -d 192.168.XX.X -p tcp -m tcp --dport 3389 -j ACCEPT

#################################################################
#################################################################
#################################################################

$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 3389 -j ACCEPT
$IPT -A FORWARD -d 192.168.XX.X -p tcp -m tcp --dport 5900 -j ACCEPT
$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 5900 -j ACCEPT
$IPT -A FORWARD -d 192.168.XX.X -p tcp -m tcp --dport 1521 -j ACCEPT
$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 1521 -j ACCEPT
$IPT -A FORWARD -d 192.168.XX.X -p tcp -m tcp --dport 1630 -j ACCEPT
$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 1630 -j ACCEPT
$IPT -A FORWARD -d 192.168.XX.X -p tcp -m tcp --dport 2610 -j ACCEPT
$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 2610 -j ACCEPT
$IPT -A FORWARD -d 192.168.XX.X -p tcp -m tcp --dport 2483 -j ACCEPT
$IPT -A FORWARD -s 192.168.XX.X -p tcp -m tcp --sport 2484 -j ACCEPT

$IPT -A FORWARD -i eth1 -s 192.168.XX.X/24 -j ACCEPT
$IPT -A FORWARD -o eth1 -m state --state NEW,INVALID -j DROP
$IPT -A FORWARD -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -j DROP
$IPT -A INPUT -j DROP

##################
#Tabela NAT#######
##################
$IPT -t nat -A POSTROUTING -s 192.168.XX.X/24 -o eth0 -j MASQUERADE
#$IPT -t nat -A PREROUTING -s 192.168.XX.X/24 -p tcp --dport 80 -j REDIRECT --to-port 3128 #Proxy Transparente
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 3389 -j DNAT --to 192.168.XX.X:3389
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 3389 -j DNAT --to 192.168.XX.X:3389
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 5900 -j DNAT --to 192.168.XX.X:5900
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 1521 -j DNAT --to 192.168.XX.X:1521
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 1630 -j DNAT --to 192.168.XX.X:1630
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 2610 -j DNAT --to 192.168.XX.X:2610
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 2483 -j DNAT --to 192.168.XX.X:2483
$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 2484 -j DNAT --to 192.168.XX.X:2484
#$IPT -t nat -A PREROUTING -d 189.51.XX.X -p tcp --dport 1630 -j DNAT --to 192.168.XX.X:1630

escastilho
(usa Ubuntu)

Enviado em 16/09/2008 - 12:06h

Cara, algumas horas depois no sábado mesmo eu já tinha achado este erro de sintaxe. Esqueçi de vim aqui avisar que tinha dado certo, mas de qualquer forma vlw pela ajuda aí.