I just realized I hadn't had iptables for real for four days and four hours. It happened after I updated iptables to the newest stable version 1.4.16.3 on Gentoo, officially released on 10/18/2012):
The problem line was like:
If you used state match, then you need to change it to be
$ sudo genlop -lu | grep iptables | tail -3 Tue May 8 08:51:55 2012 >>> net-firewall/iptables-1.4.13 Mon Nov 26 01:46:33 2012 <<< net-firewall/iptables-1.4.13 Mon Nov 26 01:46:39 2012 >>> net-firewall/iptables-1.4.16.3Yesterday, I noticed there was an error or warning during booting, but I just assumed that's some net device was about to be brought up, didn't read the exact message. Today, I read it:
$ sudo /etc/init.d/iptables start * Loading iptables state and starting firewall ... WARNING: The state match is obsolete. Use conntrack instead. iptables-restore v1.4.16.3: state: option "--state" must be specified Error occurred at line: 26 Try `iptables-restore -h' or 'iptables-restore --help' for more information. [ !! ] * ERROR: iptables failed to startFour days, four boots, should've paid more attention.
The problem line was like:
[52:3148] -A INPUT -s ###.###.###.### -p tcp -m state -m tcp --dport ### -j ACCEPTAfter I remove six lines with
-m state
, the rules /var/lib/iptables/rules-save
were loaded successfully. Don't know why I had those and didn't use to match state actually.If you used state match, then you need to change it to be
-m conntrack --ctstate [STATELIST]with kernel configuration
NETFILTER_XT_MATCH_CONNTRACK
. See man 8 iptables-extensions
.