iptables REJECT NAT Internal -> External Portrange

iptables REJECT NAT Internal -> External Portrange

[Ryan Belcher]

Hi All,

I'm trying to set up a rule that will send an icmp-host-unreachable (or similar) back to the local machine (inside the NAT) if they try to connect to an external host on a specified port range.

I know I'm missing something obvious, but I can't seem to figure out what I'm missing.

iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 10000:11000 -j REJECT --reject-with icmp-host-unreachable

The above command returns with "Invalid Argument".

If I simply replace "-j REJECT --reject-with icmp-host-unreachabel" with "-j DROP" iptables accepts it.

What am I missing?

TIA!

Ryan

Re: iptables REJECT NAT Internal -> External Portrange

[Jan Engelhardt]

>iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 10000:11000 -j REJECT --reject-with icmp-host-unreachable
>
>The above command returns with "Invalid Argument".

REJECT is to be used in -t filter.


Jan Engelhardt
-- 

RE: iptables REJECT NAT Internal -> External Portrange

[Ryan Belcher]

Yeah, I figured that out while iteratively trying to get this to work.  I guess I was using that command as more of a pseudocommand in the context of this email.  

I've tried putting *roughly* the same rule into filter:OUTPUT filter:FORWARD and nat:PREROUTING and each time I either got a complaint from iptables or when I tried to modify the rule to "fit" into the above mentioned chains it never worked (matched any packets).

Do I have to bounce this packet from one table to another to get this to work?

>iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 10000:11000 -j REJECT --reject-with icmp-host-unreachable
>
>The above command returns with "Invalid Argument".

REJECT is to be used in -t filter.


Jan Engelhardt
-- 

Re: iptables REJECT NAT Internal -> External Portrange

[Nathaniel Hall]

Ryan Belcher wrote:
> iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 10000:11000 -j REJECT --reject-with icmp-host-unreachable
> 
> The above command returns with "Invalid Argument".
> 
> If I simply replace "-j REJECT --reject-with icmp-host-unreachabel" with "-j DROP" iptables accepts it.

Did this come with a distribution or have you compiled it on your own?  I think I had a similar
problem with the iptables that came with Fedora Core because it didn't come with the REJECT module.

-- 
Nathaniel Hall, GSEC GCFW GCIA GCIH

RE: iptables REJECT NAT Internal -> External Portrange

[Ryan Belcher]

I did compile it on my own, and the REJECT target is there (I tested it under different circumstances).

Ryan

>Did this come with a distribution or have you compiled it on your own?  I think I had a similar
>problem with the iptables that came with Fedora Core because it didn't come with the REJECT module.
>
>-- 
>Nathaniel Hall, GSEC GCFW GCIA GCIH