Strange APF / iptables problem

[Mitsurugi]

For some reason, my APF / iptables has started throwing up an error when I try to use the "advanced" format for adding "deny" rules:

[~]> apf -d tcp:in:d=80:d=123.123.123.123
iptables v1.3.5: host/network `tcp:in:d=80:d=123.123.123.123' not found
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: host/network `tcp:in:d=80:d=123.123.123.123' not found
Try `iptables -h' or 'iptables --help' for more information.
apf(4605): (trust) added deny all to/from tcp:in:d=80:d=123.123.123.123

123.123.123.123 is just an example IP address, it doesn't make any difference which IP address I use.

The format is exactly correct:

tcp:in:d=80:d=123.123.123.123

Block all TCP incoming traffic to port 80 and to IP address 123.123.123.123 (which is the destination site that is being attacked, let's say, and I need to block traffic to it).

Any ideas?

 

[Mitsurugi]

And the answer is...

The format is fine for insertion into deny_hosts.rules, but APF can't add it successfully to iptables via apf -d. You can add it to deny_hosts.rules this way, but you have to restart APF to get it loaded into iptables.