While digging around in the logs for something else, I stumbled across a number of messages like this:
Mar 16 08:09:51 myhost charon: 15[CHD] updown: iptables: Bad rule (does a matching rule exist in that chain?).
Mar 16 08:09:51 myhost charon: 15[CHD] updown: iptables: No chain/target/match by that name.
Any ideas as to what’s causing this? Bad configuration on my part, or should I open a bug?
I’m guessing that the problem lies somewhere in /usr/libexec/ipsec/_updown ?
Tom
Not really a problem, because the script tries to clear rules that are no longer there anyways.
Probably the firewall chain was flushed or something else.
I was trying to fix my other ipsec issue and I stumbled across this same error (and went down the rabbit hole!)
The last three items in this area are:
iptables --wait -D IPSECINPUT
and they should be:
iptables --wait -D IPSECOUTPUT
in file /usr/libexec/ipsec/_updown:
# Close firewall for incoming and outgoing IPinIP + AH + ESP traffic to the peers' IP
iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p IPIP \
-s $PLUTO_PEER $S_PEER_PORT \
-d $PLUTO_ME $D_MY_PORT -j ACCEPT
iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p AH \
-s $PLUTO_PEER $S_PEER_PORT \
-d $PLUTO_ME $D_MY_PORT -j ACCEPT
iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p ESP \
-s $PLUTO_PEER $S_PEER_PORT \
-d $PLUTO_ME $D_MY_PORT -j ACCEPT
# iptables --wait -D IPSECINPUT -o $PLUTO_INTERFACE -p IPIP \
# -s $PLUTO_ME $D_MY_PORT \
# -d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
# iptables --wait -D IPSECINPUT -o $PLUTO_INTERFACE -p AH \
# -s $PLUTO_ME $D_MY_PORT \
# -d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
# iptables --wait -D IPSECINPUT -o $PLUTO_INTERFACE -p ESP \
# -s $PLUTO_ME $D_MY_PORT \
# -d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
iptables --wait -D IPSECOUTPUT -o $PLUTO_INTERFACE -p IPIP \
-s $PLUTO_ME $D_MY_PORT \
-d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
iptables --wait -D IPSECOUTPUT -o $PLUTO_INTERFACE -p AH \
-s $PLUTO_ME $D_MY_PORT \
-d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
iptables --wait -D IPSECOUTPUT -o $PLUTO_INTERFACE -p ESP \
-s $PLUTO_ME $D_MY_PORT \
-d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
;;
no more bad rule…
Well…I’ll be.
Thoughts, @ms ?
Not sure but does the patch mentioned here
fix that issue?
It is in CU202.
I don’t know what you are asking me 
So there has been a bug where every time a tunnel was brought up - or even renegotiated - a set of firewall rules were created but never removed.
This did not have any downsides apart from the table to be getting longer and longer. Eventually that could have harmed performance of the firewall slightly because it would have to consider more rules, but that is more of a theoretical problem.
The changes that you pointed have been implemented in this patch:
These changes are included in Core Update 202 which we are looking to release early next week.
So, thank you for confirming that we fixed the problem
I’m trying to figure out which part of this is weirder: someone replying to my six year old post with a fix, or that the issue just happens to have recently been fixed by someone else and is included in the forthcoming update.
My bad. I didn’t realize the recent patch fixed the issue.