Arch Linux User Repository

After restart iptables wasn't able to load because he wasn't able to locate the libxt_*.so library directory.
To fix this I created the file:
/etc/ld.so.conf.d/xtables.conf
and add the line:
/usr/lib/xtables

@jimbo You may want to have a look at: https://aur.archlinux.org/packages/xtables-geoip-db/

I had to execute:
cd /usr/share/xt_geoip
sudo cp /usr/lib/xtables-addons/xt_geoip .
sudo ./xt_geoip_dl
sudo ./xt_geoip_build -S GeoLite2-Country-CSV_ -D /usr/share/xt_geoip *.csv

[kernel 5.2.2-arch1-1 , x64, xtables-addons snapshot 2019-03-14 02:27 / 20190726] CC [M] /alt/packages/xtables-addons-3.3-1/xtables-addons/src/xtables-addons-3.3/extensions/pknock/xt_pknock.o /alt/packages/xtables-addons-3.3-1/xtables-addons/src/xtables-addons-3.3/extensions/pknock/xt_pknock.c: In function ‘xt_pknock_mt_init’: /alt/packages/xtables-addons-3.3-1/xtables-addons/src/xtables-addons-3.3/extensions/pknock/xt_pknock.c:1128:13: error: ‘struct shash_desc’ has no member named ‘flags’ 1128 | crypto.desc.flags = 0; | ^

I am having a strange problem on IPV6 with module geoip.

These two ip6tables don't work as expected :

ip6tables -A INPUT -p tcp -i eth0 -m multiport --dports 22,2222 -m geoip --src-cc FR -j ACCEPT

ip6tables -A INPUT -p tcp -i eth0 -m multiport --dports 22,2222 -j DROP

I can't connect via IPV6 to my SSH server, while I should be able, my ISP being in France.

If I remove line #2, I can connect successfully.

However, I can connect with :

ip6tables -A INPUT -p tcp -i eth0 -m multiport --dports 22,2222 -m geoip ! --src-cc FR -j ACCEPT

ip6tables -A INPUT -p tcp -i eth0 -m multiport --dports 22,2222 -j DROP

while reversing the criteria.

Can someone confirm that reverse logic ? It's working as expected with IPV4.

Thanks.

I found that this aur will install libxt_*.so in /usr/lib/iptables, but iptables is no longer reading so libs from there. The new location is /usr/lib/xtables.

If you ever encountered problems when executing

iptables -A OUTPUT -m geoip --dst-cc CN -j DROP or something similar, and having

Couldn't load match 'geoip':No such file or directory problem.

the temporary fix is:

ln -s /usr/lib/iptables/libxt_geoip.so /usr/lib/xtables/libxt_geoip.so

Or you can just edit the pkgbuild before build/install..

4.18.8 :( """CC [M] /alt/packages/xtables-addons-3.0-2/xtables-addons/src/xtables-addons-3.0/extensions/xt_DNETMAP.o /alt/packages/xtables-addons-3.0-2/xtables-addons/src/xtables-addons-3.0/extensions/xt_DNETMAP.c: In function ‘dnetmap_tg’: /alt/packages/xtables-addons-3.0-2/xtables-addons/src/xtables-addons-3.0/extensions/xt_DNETMAP.c:406:32: error: passing argument 2 of ‘nf_nat_setup_info’ from incompatible pointer type [-Werror=incompatible-pointer-types] return nf_nat_setup_info(ct, &newrange, ^~~~~~~~~ In file included from /alt/packages/xtables-addons-3.0-2/xtables-addons/src/xtables-addons-3.0/extensions/xt_DNETMAP.c:35: ./include/net/netfilter/nf_nat.h:42:39: note: expected ‘const struct nf_nat_range2 ’ but argument is of type ‘struct nf_nat_range ’ const struct nf_nat_range2 range, ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~ /alt/packages/xtables-addons-3.0-2/xtables-addons/src/xtables-addons-3.0/extensions/xt_DNETMAP.c:495:31: error: passing argument 2 of ‘nf_nat_setup_info’ from incompatible pointer type [-Werror=incompatible-pointer-types] return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->state->hook)); ^~~~~~~~~ In file included from /alt/packages/xtables-addons-3.0-2/xtables-addons/src/xtables-addons-3.0/extensions/xt_DNETMAP.c:35: ./include/net/netfilter/nf_nat.h:42:39: note: expected ‘const struct nf_nat_range2 ’ but argument is of type ‘struct nf_nat_range ’ const struct nf_nat_range2 range, ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~ cc1: some warnings being treated as errors """

Compiling is fine, was checked already.

can you check the compilation? /var/pacman.log: [2018-05-17 10:17] [ALPM] upgraded linux-api-headers (4.14.8-1 -> 4.16.1-1) ??; gcc-libs (7.3.1+20180312-2 -> 8.1.0-1) -big change? ; linux (4.15.14-1 -> 4.16.8-1); linux-headers (4.15.14-1 -> 4.16.8-1) ("checked already." thanks k0ste) [edit:] I'm stupid :), I worked with an old pkgbuild (Feb / 2018), I was looking at PKGBUILD pkgver = 3.0 pkgrel = 1

4.16.8 works fine.