Invalid friggen argument

Invalid friggen argument

[Herman]

Hi everybody,

I am trying to get port forwarding to work.  I had it working some time ago 
gawdknows what changed...

Now, I get this result with iptables 1.2.7a-2mdk and with 1.2.9rc1:

# iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 6390 \
 -j DNAT --to 192.168.10.245
iptables: Invalid argument

I can cut and paste a line from a howto and I still get 'invalid argument' - 
grrr...

Any ideas?

Cheers
-- 
Herman

Re: Invalid friggen argument

[Willy TARREAU]

Hi !

On Sun, Oct 12, 2003 at 01:41:15AM -0600, Herman wrote:
 
> Now, I get this result with iptables 1.2.7a-2mdk and with 1.2.9rc1:
> 
> # iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 6390 \
>  -j DNAT --to 192.168.10.245
> iptables: Invalid argument

your kernel might be too old and incompatible with these more recent versions.
I got the same when upgrading from iptables-1.2.4 to 1.2.5, IIRC.

Willy

Re: Invalid friggen argument

[Herman]

On Sunday 12 October 2003 5:08 am, Willy TARREAU wrote:
   Hi !

   On Sun, Oct 12, 2003 at 01:41:15AM -0600, Herman wrote:
   > Now, I get this result with iptables 1.2.7a-2mdk and with 1.2.9rc1:
   >
   > # iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 6390 \
   >  -j DNAT --to 192.168.10.245
   > iptables: Invalid argument

   your kernel might be too old and incompatible with these more recent
 versions. I got the same when upgrading from iptables-1.2.4 to 1.2.5, IIRC.

   Willy

Hmm, this is Mandrake 9.1 distro and it did work in the past, but kind of 
unreliably.  So I should try an older version of netfilter - any 
recommendations for a version to try?

The funny thing is that the Masquerade line in my firewall setup gives the 
same Invalid Argument error but it actually works.  It is only Port 
Forwarding that doesn't work.

Cheers,
-- 
Herman

RE: Invalid friggen argument

[Mark E. Donaldson]

I don't think you have a versioning problem.  Some of the more recent
releases of netfilter are more sensitive about arguments and argument
ordering I have found.  Are you able to slip in a destination address into
that rule:

iptables -t nat -A PREROUTING -i eth1 -p tcp -d xxx.xxx.xxx.xxx --dport 6390
\
 -j DNAT --to 192.168.10.245

It may be looking for a dest address.

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Herman
Sent: Sunday, October 12, 2003 12:41 AM
To: netfilter@lists.netfilter.org
Subject: Invalid friggen argument


Hi everybody,

I am trying to get port forwarding to work.  I had it working some time ago
gawdknows what changed...

Now, I get this result with iptables 1.2.7a-2mdk and with 1.2.9rc1:

# iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 6390 \
 -j DNAT --to 192.168.10.245
iptables: Invalid argument

I can cut and paste a line from a howto and I still get 'invalid argument' -
grrr...

Any ideas?

Cheers
--
Herman

Re: Invalid friggen argument

[Herman]

On Sunday 12 October 2003 11:44 am, Mark E. Donaldson wrote:
   I don't think you have a versioning problem.  Some of the more recent
   releases of netfilter are more sensitive about arguments and argument
   ordering I have found.  Are you able to slip in a destination address into
   that rule:

   iptables -t nat -A PREROUTING -i eth1 -p tcp -d xxx.xxx.xxx.xxx --dport
 6390 \
    -j DNAT --to 192.168.10.245

   It may be looking for a dest address.

I have tried that before and here goes:
iptables -t nat -A PREROUTING -i eth1 -p tcp -d 192.168.10.100 --dport 6390 -j 
DNAT --to 192.168.10.245
iptables: Invalid argument

No luck.

Cheers,
-- 
Herman 

Re: Invalid friggen argument

[Herman]

On Sunday 12 October 2003 7:01 pm, Herman@aerospacesoftware.com wrote:
   I understand now.  The machines that you are DNATTING to are dynamic, and
   may or may not be on-line and listening.  The service port is Java based
   (sounds like Sun Microsystems Netlet protocol) but I gather it will always
   be the same listening port, it is just the IP that changes.  This is the
   deal:  you have an extra layer of complexity here that IPTables by nature
 is not designed to handle.  That's not to say it cannot be done.  You are
 going to need to build some dynamic variables into your script that run some
 test for active IP's upon match of the port forwarding rule.  Based on the
 test results, you can tell IPTables what where to forward.  For example,
 when the rule is encountered, you could send a Ping to all the potential
 hosts, then grab the IP of the host that responds, and then set iptables to
 DNAT to that IP.  That is just one way to accomplish this.  So, it is
 possible, but it is going to take some extra work.

Yikes - I think I'll settle for a fixed IP on one machine for starters.  That 
is proving to be enough of a headache.


   As for your modules, masquerade works off it's own specific module so it
   working is no indication of NAT working.

OK, that is beginning to make sense.  So I have to try and figure out what 
module is used for nat and see whether it is loaded.

Thanks!
-- 
Herman Oosthuysen 
B.Eng(E), MIEEE
Aerospace Software Ltd.
Ph: 1.403.241-8773, Cell: 1.403.852-5545, Fx: 1.403.241-8841
Herman@AerospaceSoftware.com, http://www.AerospaceSoftware.com

Re: Invalid friggen argument

[Joel Newkirk]

On Sun, 2003-10-12 at 03:41, Herman wrote:
> Hi everybody,
> 
> I am trying to get port forwarding to work.  I had it working some time ago 
> gawdknows what changed...
> 
> Now, I get this result with iptables 1.2.7a-2mdk and with 1.2.9rc1:
> 
> # iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 6390 \
>  -j DNAT --to 192.168.10.245
> iptables: Invalid argument

Have you checked lsmod, to make sure you have iptable_nat loaded?  If
not, try "modprobe iptable_nat" then try your rule again.

j

Re: Invalid friggen argument

[Herman]

On Tuesday 14 October 2003 12:04 am, Joel Newkirk wrote:
   Have you checked lsmod, to make sure you have iptable_nat loaded?  If
   not, try "modprobe iptable_nat" then try your rule again.

The trouble was not iptable_nat, but rather iptable_mangle.  It seems that nat 
doesn't work if iptable_mangle is not loaded - who woulda thunkit?

I was mislead by a Rehat script, which stated that it isn't needed for nat, 
but apparently it is indeed.

Cheers,
-- 
Herman