[SOLVED] iptables LOG target not recognized

[wcg]

iptables is reporting the LOG target as unrecognized.

iptables-1.4.0-r1
linux-2.6.27-gentoo-r7
CHOST=x86_64-pc-linux-gnu

It is enabled in the kernel config:
....
CONFIG_NETFILTER=y
....
CONFIG_IP_NF_IPTABLES=y
CONFIG_IP_NF_FILTER=y
....
CONFIG_IP_NF_TARGET_LOG=y

Example:

/sbin/iptables -A INPUT -i eth+ -s $MYHOST_IP \
-d \! $MY_SUBNET_BROADCAST -m limit -j LOG \
--log-ip-options --log-tcp-options

(Next iptables command in the firewall script
drops anything incoming on ethernet with
$MY_HOST_IP for source address.)

iptables reports:

iptables: No chain/target/match by that name

This happens for every iptables command with
a "-j LOG" target.

Works fine with iptables-1.3.8 and linux-2.6.26.5
on an x86 (unpatched vanilla sources).

?

(The only thing that looks maybe relevant in
USE= in make.conf is "-isdnlog". I disabled
it because I have no isdn interfaces installed.
I don't see how that would affect iptables.)
_________________
TIA

[wcg]

PS: system logger is sysklogd.
_________________
TIA

[toralf]

Your're sure to put "-j LOG" to a specific filter rule ? What's about using a more general approach like this :

[wcg]

A lot of junk that a chain might handle
I don't want in my logs (netbios broadcasts
from winboxes, etc), so I prefer to use the
-j LOG target in specific rules for those kinds
of packets that I do want to see a report on.

But the '-j LOG" iptables target should be
recognized by iptables either way when
it is enabled in the kernel config for a
compiled and installed kernel.

I'll try reverting iptables to 1.3.8-r? and/or
a newer version from testing and see if that
fixes it. At least I should be able to find out
whether the problem is in the iptables source
or the kernel source. (Does not seem like
a compiler problem.)
_________________
TIA

[tutaepaki]

[wcg]

[quote="tutaepaki"][quote]iptables: No chain/target/match by that name[/quote]

Note the message. It may refer to chain, target, or match...

The chain and target are probably fine, and it's the rate limiting module missing.
[quote]-m limit[/quote]
Are you sure that module is set up in your kernel too?

Regards[/quote]

Bingo. There are bunch of netfilter config options
that only show up in make menuconfig for kernel 2.6.27+
if you enable "Advanced Netfilter Configuration" before
descending into the next submenu. I did not have
that enabled, so I was not seeing them, and
CONFIG_XT_NETFILTER_MATCH_LIMIT was one of them
(along with a few others that I use).

Fixed.
_________________
TIA

[tbaac]