Problems after recompiling iptables 1.2.7 ..

Problems after recompiling iptables 1.2.7 ..

[Raymond Leach]

[-- Attachment #1: Type: text/plain, Size: 1326 bytes --]

Hi

I have a problem with NAT after recompiling iptables and my kernel.

This line gives an 'invalid argument' error:
iptables -t nat -A PREROUTING -i eth0 -s 192.168.0.0/24 -j SNAT
--to-source 196.4.160.2

Is there something wrong with the above line, or is there something
wrong with my kernel or iptables?

kernel version = 2.4.20 - 'Full Nat' is enabled
patch-o-matic 'time' patch applied
iptables version = 1.2.7

There were no errors during compile. Although, after rebooting the
machine complains about a missing map file.

Regards

Ray
-- 
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(  Raymond Leach                       )
 ) Knowledge Factory                  (
(                                      )
 ) Tel: +27 11 445 8100               (
(  Fax: +27 11 445 8101                )
 )                                    (
(  http://www.knowledgefactory.co.za/  )
 ) http://www.saptg.co.za/            (
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   o                                o
    o                              o
        .--.                  .--.
       | o_o|                |o_o |
       | \_:|                |:_/ |
      / /   \\              //   \ \
     ( |     |)            (|     | )
     /`\_   _/'\          /'\_   _/`\
     \___)=(___/          \___)=(___/

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Problems after recompiling iptables 1.2.7 ..

[Fabio Corneti]

On Monday 20 January 2003 08:59, Raymond Leach wrote:
> Hi
>
> I have a problem with NAT after recompiling iptables and my kernel.
>
> This line gives an 'invalid argument' error:
> iptables -t nat -A PREROUTING -i eth0 -s 192.168.0.0/24 -j SNAT
> --to-source 196.4.160.2
>
> Is there something wrong with the above line, or is there something
> wrong with my kernel or iptables?
>
> kernel version = 2.4.20 - 'Full Nat' is enabled
> patch-o-matic 'time' patch applied
> iptables version = 1.2.7
>
> There were no errors during compile. Although, after rebooting the
> machine complains about a missing map file.
>
> Regards
>
> Ray

Shouldn't be specified an output interface/address with the -o option? 
Moreover, I think that if you want to do source nat, you should do it in the 
POSTROUTING chain. Try this (the existence of another network card eth1 is 
presumed):

iptables -t nat -A POSTROUTING -i eth0 -o eth1 -s 192.168.0.0/24 -j SNAT
--to-source 196.4.160.2

-- 
Fabio Corneti
fabio@gekolab.it

Re: Problems after recompiling iptables 1.2.7 ..

[Ranjeet Shetye]

On Mon, 2003-01-20 at 14:32, Fabio Corneti wrote:
> On Monday 20 January 2003 08:59, Raymond Leach wrote:
> > Hi
> >
> > I have a problem with NAT after recompiling iptables and my kernel.
> >
> > This line gives an 'invalid argument' error:
> > iptables -t nat -A PREROUTING -i eth0 -s 192.168.0.0/24 -j SNAT
> > --to-source 196.4.160.2
> >
> > Is there something wrong with the above line, or is there something
> > wrong with my kernel or iptables?
> >
> > kernel version = 2.4.20 - 'Full Nat' is enabled
> > patch-o-matic 'time' patch applied
> > iptables version = 1.2.7
> >
> > There were no errors during compile. Although, after rebooting the
> > machine complains about a missing map file.
> >
> > Regards
> >
> > Ray
> 
> Shouldn't be specified an output interface/address with the -o option? 
> Moreover, I think that if you want to do source nat, you should do it in the 
> POSTROUTING chain. Try this (the existence of another network card eth1 is 
> presumed):
> 
> iptables -t nat -A POSTROUTING -i eth0 -o eth1 -s 192.168.0.0/24 -j SNAT
> --to-source 196.4.160.2
> 
> -- 
> Fabio Corneti
> fabio@gekolab.it
> 

You are right.

SNAT MUST be done in the POSTROUTING chain.

Also, it MUST take an outgoing interface.

The incoming interface MAY BE specified if you have specific needs.

Ranjeet.

Re: Problems after recompiling iptables 1.2.7 ..

[Martin Josefsson]

On Mon, 2003-01-20 at 09:05, Ranjeet Shetye wrote:

> > Shouldn't be specified an output interface/address with the -o option? 
> > Moreover, I think that if you want to do source nat, you should do it in the 
> > POSTROUTING chain. Try this (the existence of another network card eth1 is 
> > presumed):
> > 
> > iptables -t nat -A POSTROUTING -i eth0 -o eth1 -s 192.168.0.0/24 -j SNAT
> > --to-source 196.4.160.2
> > 
> > -- 
> > Fabio Corneti
> > fabio@gekolab.it
> > 
> 
> You are right.
> 
> SNAT MUST be done in the POSTROUTING chain.
> 
> Also, it MUST take an outgoing interface.
> 
> The incoming interface MAY BE specified if you have specific needs.

This is incorrect.

It is correct that SNAT must be performed in the nat/POSTROUTING chain.
but it is OPTIONAL to specify an outgoing interface. And you can NEVER
specify an incoming interface in POSTROUTING.

-- 
/Martin

Never argue with an idiot. They drag you down to their level, then beat you with experience.