What's new

Layer7 broken?

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

ingenium

Occasional Visitor
Whenever I try to add an iptables rule with layer7, such as:

Code:
iptables -t mangle -A QOSO -p tcp -m layer7 --l7proto bittorrent -j CONNMARK --set-return 0x5/0xff

it returns:

Code:
iptables: No chain/target/match by that name

I can't see a layer7 module loaded, so maybe it's compiled into the kernel? If I try to change l7proto to something else, say "test", it returns:

Code:
iptables v1.3.8: Couldn't find a pattern definition file for test.

So it's clearly finding the pattern rules in /etc/l7-protocols/. There must be some other problem going on.

EDIT: I may as well ask another related question in the same thread. If I want to add custom QoS rules, should I have it in the firewall-start script or the nat-start script? Or does it not matter? Basically I don't want the rules being re-added if the mangle table hasn't been flushed... does adding a port forward via the webui just flush the nat table or does it re-load the whole firewall?
 
Last edited:
I found the directory where all the kernel modules are, and there was a layer7 module in there. Running "modprobe xt_layer7" fixed the issue.
 

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top