Re: IPtables FORWARD syntax question/error

[Alistair Tonner <Alistair@nerdnet.ca>]

On July 10, 2004 04:40 am, Antony Stone wrote:
> On Friday 09 July 2004 5:12 pm, Eric Ellis wrote:
> > I have a webcache/external proxy on the network that I want to route all
> > web traffic from Squid to.  I assumed the following to work:
> >
> > iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination
> > xx.xx.xx.xx:8080
> >
> > the thing is that it gives me the error "invalid argument".  Here's what
> > else I've tried, with errors:
> >
> > root@firewall:/etc# iptables -t nat -A POSTROUTING -p tcp --dport 80 -j
> > DNAT --to-destination xx.xx.xx.xx:8080
> > iptables: Invalid argument
>
> DNAT is not valid in the POSTROUTING chain, only PREROUTING and OUTPUT.
>
> > root@firewall:/etc# iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT
> > --to-destination xx.xx.xx.xx:8080
> > iptables: Invalid argument
>
> That looks like a valid rule to me (but see below).

	Umm ... could we have TWO copies of iptables involved here?? or a 
	recompiled kernel without a recompile of iptables userspace code????

	
	Alistair Tonner.

	
> Regards,
>
> Antony.