3

This is a fresh copy of ubuntu on my nVidia Jetson Nano, and I am trying to add the following rule to block network access for user 1001.

sudo iptables -A OUTPUT ! -o lo -m owner --uid-owner 1001 -j DROP

I get the following error:

iptables: No chain/target/match by that name.

Here is what I tried that works(YES) and does not work(NOT)

  1. YES - Remove the match criteria and replace with some other condition like source or target
  2. YES - On another similar installation on raspberry pi
  3. NOT - Change chain or target to INPUT or ACCEPT etc..
  4. NOT - Use a different user
  5. NOT - Try using user names instead of user ID
  6. NOT - Try a different match like --gid-owner
  7. NOT - Flushing the tables, restarting the PC etc
  8. NOT - Removed the ! -o lo from the command above

This is beyond me, I really have tried a lot of things and read through a number of posts with the same error - most of the times they are trying to do something complex - yet this is simple (and works on my other installation!). Any thoughts on how to understand this would be appreciated. Thanks!

EDIT: Based on comment below, here are the outputs:

grep CONFIG_NETFILTER_XT_MATCH /boot/config-$(uname -r)

grep: /boot/config-4.9.140-tegra: No such file or directory

I manually checked for the file and there's no file that starts with config-XX in the boot folder. Additionally:

iptables -m owner --help

Could not determine whether revision 1 is supported, assuming it is.

....

owner match options:

[!] --uid-owner userid[-userid] Match local UID

[!] --gid-owner groupid[-groupid] Match local GID

[!] --socket-exists Match if socket exists

  • After further investigation it seems that the netfilter match extension might not be available to be. I am not sure how to check this, and how to install it. Help here would be great! – ste_kwr May 5 '19 at 7:55
  • 1
    You an check the available match modules of your kernel with grep CONFIG_NETFILTER_XT_MATCH /boot/config-$(uname -r). To test if the specific module is usable you could use iptables -m owner --help. – Thomas May 5 '19 at 11:25
  • grep: /boot/config-4.9.140-tegra: No such file or directory - that's the error I get. I am on 18.04. However, when running the second command I see the option that I need - but with a message on the top that says - " Could not determine whether revision 1 is supported, assuming it is." – ste_kwr May 5 '19 at 17:22
1
+100

sudo modinfo ipt_owner

Should return information about the module if it's loaded or not. In most desktop / server distros it comes compiled into the kernel and would be listed here.

you can try loading it with sudo modprobe ipt_owner

but if it is like I suspect your distribution doesn't bundle it. Possibly you are not using a "official" Ubuntu release but one built from ubuntu sources by some third party?

Then you need to download your kernel sources and compile the module yourself to support your use-case

| improve this answer | |
  • Hi, this is very helpful. Yes, the module is not found in directory /lib/modules/4.9.140-tegra. Can you guide me to how I can "download kernel sources and compile the module myself" - I am not sure what that means. – ste_kwr May 8 '19 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.