Skip to content
Browse

/errors/iptables/no-chain-target-match-by-that-name

iptables: No chain/target/match by that name.

The commands on this page have not been executed by our verification runner yet.updated
tool
iptables / nftables
exit code
1
versions
iptables 1.8 (nf_tables and legacy backends)
os
linux

iptables: No chain/target/match by that name. means a name in your command does not exist in the kernel: a chain (in the table you are using), a target after -j, or a match module after -m. Most often a rule jumps to a user-defined chain that has not been created yet, or a NAT target is used without -t nat. List the chains with iptables -t TABLE -L -n, create missing chains with iptables -N, and check that the needed kernel modules are available.

Typical triggers

bash
iptables -A INPUT -j MYCHAIN                  # MYCHAIN not created yet
iptables -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.0.2   # PREROUTING exists only in nat/mangle/raw
iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT   # module missing in the kernel

Fixed versions:

bash
iptables -N MYCHAIN
iptables -A INPUT -j MYCHAIN
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.0.2
modprobe xt_conntrack

Variants of the message

The legacy backend prints the short form above. The nf_tables backend (default on current distributions) gives more specific messages for some cases: iptables v1.8.7 (nf_tables): Chain 'MYCHAIN' does not exist when you append to or list a chain that is missing, and Couldn't load target `NAME':No such file or directory when iptables finds neither a chain nor a target extension with that name after -j. For deleting a rule that is not there, both backends print iptables: Bad rule (does a matching rule exist in that chain?).

Docker

iptables: No chain/target/match by that name together with Error response from daemon: driver failed programming external connectivity means Docker's DOCKER chains in the nat and filter tables were removed, usually because firewalld or an iptables restore flushed the rules after Docker started. Restart Docker (systemctl restart docker) so it recreates them, and make the firewall service start before Docker.

Find what is missing

bash
iptables -t filter -L -n | grep '^Chain'
iptables -t nat -L -n | grep '^Chain'
lsmod | grep -E '^(xt_|nf_|ip_tables)'

Sources

Related pages

errors · iptablesiptables: Permission denied (you must be root)iptables needs root or CAP_NET_ADMIN to read or change rules. Run it with sudo; in Docker or Kubernetes add the NET_ADMIN capability, not privileged mode.commands · iptablesiptables -L -n -v --line-numbers: list rules with counters and numberssudo iptables -L -n -v --line-numbers lists rules with counters and numbers. Read the output, list the nat table, and delete or insert rules by their number.commands · iptablesSave iptables rules permanently: iptables-save, iptables-restore and persistence after rebootiptables rules vanish at reboot. Save with iptables-save, load with iptables-restore, and persist them with netfilter-persistent on Debian or iptables-services.compare · iptablesiptables vs nftables: differences and migrationnftables replaces iptables, ip6tables, arptables and ebtables with one tool, nft, one syntax and atomic updates; iptables-nft keeps iptables commands working.