Problem with DNAT

Problem with DNAT

[Steffen Schoenwiese]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I have some problems with iptables 1.2.7a. Some of my rules which worked well 
with iptables 1.2.5 produce an error message "iptables: Invalid argument". 
The specific rules look like this:

iptables -t nat -A OUTPUT -p tcp -d <ip> -j DNAT --to <ip>:<port>

I also tried to use --to-destination instead of --to, same error message.
All my other rules work perfect, only the DNAT ones get this error. 
Does anyone have a possible solution?

Steffen  

- -- 
Quote of the minute:

"Premature optimization is the root of all evil."    
	-Donald E. Knuth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE9zUe7ByWeP+lxCPMRAmuOAKC0UimprHxQb+TqyT8QZlLP/n1Q+gCgilKT
Wdo7eVFbg3FJshcDVBmrX88=
=GyFD
-----END PGP SIGNATURE-----

Re: Problem with DNAT

[Joel Newkirk]

On Saturday 09 November 2002 12:36 pm, Steffen Schoenwiese wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi,
>
> I have some problems with iptables 1.2.7a. Some of my rules which worked
> well with iptables 1.2.5 produce an error message "iptables: Invalid
> argument". The specific rules look like this:
>
> iptables -t nat -A OUTPUT -p tcp -d <ip> -j DNAT --to <ip>:<port>
>
> I also tried to use --to-destination instead of --to, same error message.
> All my other rules work perfect, only the DNAT ones get this error.
> Does anyone have a possible solution?

All nat table rules, or are SNAT and MASQ accepted?  Do you have a insmod or 
modprobe iptable_nat?  I don't know your prior/current setup, but it might 
have been compiled in before, a module now.

j

Re: Problem with DNAT

[Steffen Schoenwiese]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> >
> > Hi,
> >
> > I have some problems with iptables 1.2.7a. Some of my rules which worked
> > well with iptables 1.2.5 produce an error message "iptables: Invalid
> > argument". The specific rules look like this:
> >
> > iptables -t nat -A OUTPUT -p tcp -d <ip> -j DNAT --to <ip>:<port>
> >
> > I also tried to use --to-destination instead of --to, same error message.
> > All my other rules work perfect, only the DNAT ones get this error.
> > Does anyone have a possible solution?
>
> All nat table rules, or are SNAT and MASQ accepted?  Do you have a insmod
> or modprobe iptable_nat?  I don't know your prior/current setup, but it
> might have been compiled in before, a module now.
>
> j

SNAT doesn't work either, MASQ works. iptable_nat is loaded. The system I'm 
running is a new SuSE 8.1 if that helps.

Steffen

- -- 
Quote of the minute:

printk("Illegal format on cdrom.  Pester manufacturer.\n"); 
	2.2.16 /usr/src/linux/fs/isofs/inode.c
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE9zXHcByWeP+lxCPMRAhc/AKCGP5TvNZg6MWpaHxhEm8v4XgCqIwCgk7rH
Ib5KwPR9klcbUfJcQxrfGKo=
=DbIC
-----END PGP SIGNATURE-----

Re: Problem with DNAT

[Joel Newkirk]

On Saturday 09 November 2002 03:36 pm, Steffen Schoenwiese wrote:
> > > I have some problems with iptables 1.2.7a. Some of my rules which
> > > worked well with iptables 1.2.5 produce an error message "iptables:
> > > Invalid argument". The specific rules look like this:
> > >
> > > iptables -t nat -A OUTPUT -p tcp -d <ip> -j DNAT --to <ip>:<port>
> > >
> > > I also tried to use --to-destination instead of --to, same error
> > > message. All my other rules work perfect, only the DNAT ones get this
> > > error. Does anyone have a possible solution?
> >
> > All nat table rules, or are SNAT and MASQ accepted?  Do you have a insmod
> > or modprobe iptable_nat?  I don't know your prior/current setup, but it
> > might have been compiled in before, a module now.
>
> SNAT doesn't work either, MASQ works. iptable_nat is loaded. The system I'm
> running is a new SuSE 8.1 if that helps.

The same rule is accepted if it's prerouting? What about without the port redirection?

SUSE8.1 is kernel 2.4.19, right?  This shouldn't apply then but...
From the "Known Bugs" file in the 1.2.7a distribution:

1) NAT in the OUTPUT chain only works since kernel 2.4.18.  However,
   there is a patch for previous kernels in patch-o-matic, called the
   'local-nat.patch'.  This patch adds a CONFIG_NF_IP_NAT_LOCAL kernel config
   option.

I'm still running 1.2.5, so I can't even try this locally right now.  Sorry.

j