DNAT in OUTPUT chain

DNAT in OUTPUT chain

[Daniel Khan]

Hello List,

I have a Problem with NAT on RedHat 7.3/iptables v1.2.5.

I have 2 Hosts. I want to redirect every connection to Port 3306 on Host1 to
Port 3306 on Host2.
That is no problem as long I make an external connection (Prerouting).

I also need to redirect connections to localhost:3306.
According to the Howto's I need to set this in the OUTPUT chain.
So I use exactly the syntax from the HOWTO's:

iptables -A OUTPUT -t nat -p tcp --dport 3306 -j DNAT --to 10.1.0.212:3306

iptables reports:
"Invalid Argument"

I've allready played arround using -i lo, etc. The same errors.
It simply seems as if DNAT on OUTPUT isn't possible, but the HOWTO's say it
is.

I also read, that OUTPUT DNAT was a Problem in 2001, but that's long ago I
think.

Please help!

Thanks in advance

Daniel Khan

Re: DNAT in OUTPUT chain

[Karl Fischer]

Daniel Khan wrote:
> 
> Hello List,
> 
> I have a Problem with NAT on RedHat 7.3/iptables v1.2.5.
>
> So I use exactly the syntax from the HOWTO's:
> 
> iptables -A OUTPUT -t nat -p tcp --dport 3306 -j DNAT --to 10.1.0.212:3306

I just copied and pasted this line to my machine and it works fine here.
However, according to the man-page, I would try the following:

iptables -A OUTPUT -t nat -p tcp -m tcp --dport 3306 \
  -j DNAT --to-destination 10.1.0.212:3306

HTH

- Karl