I have the following Iptables version:

sh# iptables --version
iptables v1.4.21

The help page contains this line:

--check   -C chain      Check for the existence of a rule

I have such a rule in iptables-save:

-A PREROUTING -p udp -m udp --dport 5060 -j CT --helper sip

But when I'm trying to check (-C) it I see such output:

sh# iptables -C PREROUTING -p udp -m udp --dport 5060 -j CT --helper sip
iptables: Bad rule (does a matching rule exist in that chain?).

What is the reason? Could some bug be in Iptables?


Try adding a -t nat so you select the NAT table, or maybe -t mangle. Pretty sure it will default to looking at the filter table, which won't have a PREROUTING chain. You need to specify which table you are looking at.

sh# iptables -C PREROUTING -t nat -p udp -m udp --dport 5060 -j CT --helper sip