I am trying to do a routing rule to a bunch a subdomains matched by regular expression.

iptables -t nat -A PREROUTING -m string --string "/must-[a-z0-9-\.]+gonow[a-z\.]+/g" --algo regex -p tcp -m tcp --dport 12 -j DNAT --to-destination

getting error - iptables: No chain/target/match by that name.


The problem is that you are attempting to use a relatively slow pattern matching algorithm in an application that MUST use a fast pattern matching algorithm. Also know that the entire use of the "string" filter can be compute intensive, and for that reason just a few years ago that module was not available by default. You will have to learn either the Boyer-Moore (bm) or Knuth-Pratt-Morris (kmp) fast string matching algorithms and use one of those.

See also the manual pages for iptables-extensions. Excerpt:

   --algo {bm|kmp}
          Select the pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris)
| improve this answer | |

Some thoughts if not a solution:

  • Available parameters for the --algo option are bm or kmp. "regex" is not included, as noted.

  • I'm not certain either way whether an iptables command can incorporate regex. Perhaps not, by design, or perhaps so, because iptables presumably has access to the full range of shell/Bash syntax.

  • If regex is to work, one must attend closely to quoting. Regex often is hard/single quoted, for example.

  • I expect the issue depends on the distinction between an iptables command and an iptables rule. The command itself is not a rule but instead directs iptables to render a rule, which then resides in memory. The command may accept regex (e.g., in specifying a range, causing iptables to render a discrete rule for each member or increment of the range) simply because it is executed in a shell that permits it. It's another question, however, whether iptables permits passing regex to a rule, or evaluation of regex in a rule. @Doug's response suggests not, or at least that better alternatives exist. I expect at the least that getting regex to work in a rule will require some fancy and attentive quoting.

  • If you're simply looking to automate rule generation, perhaps consider a for-loop and incorporate your regex there or in a variable definition, e.g.,

local CLIENT
for CLIENT in $LAN; do
        iptables -A dns-clients -s $CLIENT -j dns-ports
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.