Arch Linux User Repository

This is bug report page: https://codeberg.org/jengelh/xtables-addons/issues

Or you can subscribe (optional) and post to: netfilter-devel@vger.kernel.org

This is bug report page: https://codeberg.org/jengelh/xtables-addons/issues

Or you can subscribe (optional) and post to: netfilter-devel@vger.kernel.org

@punkrockguy318, seems project change home page couple a weeks ago. I updated pkgbuild, should builds fine on kernel 5.9 and 5.10. Thanks!

Not currently able to compile this; getting the same error kenubi was getting in 2018

error: initialization of ‘int ()(struct sock , int, sockptr_t, unsigned int)’ from incompatible pointer type ‘int ()(struct sock , int, void *, unsigned int)’ [-Werror=incompatible-pointer-types]

@jimbo You may want to have a look at: https://aur.archlinux.org/packages/xtables-geoip-db/

I had to execute:
cd /usr/share/xt_geoip
sudo cp /usr/lib/xtables-addons/xt_geoip .
sudo ./xt_geoip_dl
sudo ./xt_geoip_build -S GeoLite2-Country-CSV_ -D /usr/share/xt_geoip *.csv

[kernel 5.2.2-arch1-1 , x64, xtables-addons snapshot 2019-03-14 02:27 / 20190726] CC [M] /alt/packages/xtables-addons-3.3-1/xtables-addons/src/xtables-addons-3.3/extensions/pknock/xt_pknock.o /alt/packages/xtables-addons-3.3-1/xtables-addons/src/xtables-addons-3.3/extensions/pknock/xt_pknock.c: In function ‘xt_pknock_mt_init’: /alt/packages/xtables-addons-3.3-1/xtables-addons/src/xtables-addons-3.3/extensions/pknock/xt_pknock.c:1128:13: error: ‘struct shash_desc’ has no member named ‘flags’ 1128 | crypto.desc.flags = 0; | ^

I am having a strange problem on IPV6 with module geoip.

These two ip6tables don't work as expected :

ip6tables -A INPUT -p tcp -i eth0 -m multiport --dports 22,2222 -m geoip --src-cc FR -j ACCEPT

ip6tables -A INPUT -p tcp -i eth0 -m multiport --dports 22,2222 -j DROP

I can't connect via IPV6 to my SSH server, while I should be able, my ISP being in France.

If I remove line #2, I can connect successfully.

However, I can connect with :

ip6tables -A INPUT -p tcp -i eth0 -m multiport --dports 22,2222 -m geoip ! --src-cc FR -j ACCEPT

ip6tables -A INPUT -p tcp -i eth0 -m multiport --dports 22,2222 -j DROP

while reversing the criteria.

Can someone confirm that reverse logic ? It's working as expected with IPV4.

Thanks.

UPDATE : This reverse logic is found fixed in 3.9-1.

I found that this aur will install libxt_*.so in /usr/lib/iptables, but iptables is no longer reading so libs from there. The new location is /usr/lib/xtables.

If you ever encountered problems when executing

iptables -A OUTPUT -m geoip --dst-cc CN -j DROP or something similar, and having

Couldn't load match 'geoip':No such file or directory problem.

the temporary fix is:

ln -s /usr/lib/iptables/libxt_geoip.so /usr/lib/xtables/libxt_geoip.so

Or you can just edit the pkgbuild before build/install..