This is a fresh copy of ubuntu on my nVidia Jetson Nano, and I am trying to add the following rule to block network access for user 1001.
sudo iptables -A OUTPUT ! -o lo -m owner --uid-owner 1001 -j DROP
I get the following error:
iptables: No chain/target/match by that name.
Here is what I tried that works(YES) and does not work(NOT)
- YES - Remove the match criteria and replace with some other condition like source or target
- YES - On another similar installation on raspberry pi
- NOT - Change chain or target to INPUT or ACCEPT etc..
- NOT - Use a different user
- NOT - Try using user names instead of user ID
- NOT - Try a different match like --gid-owner
- NOT - Flushing the tables, restarting the PC etc
- NOT - Removed the
! -o lo
from the command above
This is beyond me, I really have tried a lot of things and read through a number of posts with the same error - most of the times they are trying to do something complex - yet this is simple (and works on my other installation!). Any thoughts on how to understand this would be appreciated. Thanks!
EDIT: Based on comment below, here are the outputs:
grep CONFIG_NETFILTER_XT_MATCH /boot/config-$(uname -r)
grep: /boot/config-4.9.140-tegra: No such file or directory
I manually checked for the file and there's no file that starts with config-XX in the boot folder. Additionally:
iptables -m owner --help
Could not determine whether revision 1 is supported, assuming it is.
....
owner match options:
[!] --uid-owner userid[-userid] Match local UID
[!] --gid-owner groupid[-groupid] Match local GID
[!] --socket-exists Match if socket exists
grep CONFIG_NETFILTER_XT_MATCH /boot/config-$(uname -r)
. To test if the specific module is usable you could useiptables -m owner --help
. – Thomas May 5 '19 at 11:25