OpenVPN AS, customize firewall rule

mziaei

Hi,

I like to customize iptables firewall rule after OpenVPN started but I'm getting error that the chain does not exist.

for example:
iptables -I ASO_ACCESS -s 12.34.56.78 -j DROP

But I get:
iptables: No chain/target/match by that name.

I can not even list the rules for specific chain:
iptables -L ASO_ACCEPT

iptables: No chain/target/match by that name.

Does anyone know why is that and how can I add more rules to ASO_ACCESS?

Thanks,

maikcat

possibly because you have to issue first

iptables -N ASO_ACCESS

Michael.

mziaei

Thanks Michael,
But, the chain is already created by openvpn-as.

iptables -L shows the chain is already there (any many other chains)

Here is part of the output of iptables -L

[root@linux ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
AS0_WEBACCEPT  all  --  anywhere             anywhere            state RELATED,ESTABLISHED
AS0_WEBACCEPT  tcp  --  anywhere             anywhere            state NEW tcp dpt:943
AS0_ACCEPT  all  --  anywhere             anywhere            state RELATED,ESTABLISHED
AS0_ACCEPT  all  --  anywhere             anywhere
AS0_IN_PRE  all  --  anywhere             anywhere            mark match 0x2000000/0x2000000
AS0_ACCEPT  tcp  --  anywhere             anywhere            state NEW tcp dpt:443

.....

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
AS0_ACCEPT  all  --  anywhere             anywhere            state RELATED,ESTABLISHED
AS0_IN_PRE  all  --  anywhere             anywhere            mark match 0x2000000/0x2000000
AS0_OUT_S2C  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
AS0_OUT_LOCAL  all  --  anywhere             anywhere

Chain AS0_ACCEPT (4 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain AS0_IN (4 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             5.5.0.1
ACCEPT     all  --  anywhere             10.0.0.0/24
AS0_IN_POST  all  --  anywhere             anywhere

Chain AS0_IN_POST (1 references)
target     prot opt source               destination
AS0_OUT    all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere

Chain AS0_IN_PRE (2 references)
target     prot opt source               destination
AS0_IN     all  --  anywhere             5.5.0.0/20
AS0_IN     all  --  anywhere             192.168.0.0/16
AS0_IN     all  --  anywhere             172.16.0.0/12
AS0_IN     all  --  anywhere             10.0.0.0/8
ACCEPT     all  --  anywhere             anywhere

Chain AS0_OUT (2 references)
target     prot opt source               destination
DROP       all  --  anywhere             default
AS0_OUT_POST  all  --  anywhere             anywhere

Chain AS0_OUT_LOCAL (1 references)
target     prot opt source               destination
DROP       icmp --  anywhere             anywhere            icmp redirect
ACCEPT     all  --  anywhere             anywhere

Chain AS0_OUT_POST (2 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

Chain AS0_OUT_S2C (1 references)
target     prot opt source               destination
AS0_OUT    all  --  anywhere             anywhere

Chain AS0_U_MZIAEI_OUT (0 references)
target     prot opt source               destination
ACCEPT     all  --  5.5.0.0/20           anywhere
AS0_OUT_POST  all  --  anywhere             anywhere

Chain AS0_WEBACCEPT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

but if I specifically specify the chain name, then it fails!

[root@linux ~]# iptables -L ASO_ACCEPT
iptables: No chain/target/match by that name.