local NAT; reconfigured kernel, problems still

local NAT; reconfigured kernel, problems still

[Noino]

Dear List, 

I recompiled my Linux 2.6.5 kernel, adding the option required for local NAT 
. 

Am still encountering problems nonetheless. I wonder whether I shouldn't 
compile the iptables program itself from source, too. 

Else why do I get "invalid argument" here ? (same without "-o lo") :
___________________________________________________________________________
# iptables -t nat -A OUTPUT -o lo -p udp --dport 53 -j DNAT --to-destination 
:10053
iptables: Invalid argument
#
____________________________________________________________________________ 

-- 
Noino

Re: local NAT; reconfigured kernel, problems still

[Eljas Alakulppi]

Hey.

1. Are you trying to redirect traffic directed to port 53 to port 10053?  
Use REDIRECT target.  
http://www.linuxtopia.org/Linux_Firewall_iptables/x4508.html
2. DNAT requires destination IP as well.

Noino <mg8c1zu02@sneakemail.com> kirjoitti Tue, 01 Apr 2008 00:06:08 +0300:

> Dear List, I recompiled my Linux 2.6.5 kernel, adding the option  
> required for local NAT . Am still encountering problems nonetheless. I  
> wonder whether I shouldn't compile the iptables program itself from  
> source, too. Else why do I get "invalid argument" here ? (same without  
> "-o lo") :
> ___________________________________________________________________________
> # iptables -t nat -A OUTPUT -o lo -p udp --dport 53 -j DNAT  
> --to-destination :10053
> iptables: Invalid argument
> #
> ____________________________________________________________________________

Re: local NAT; reconfigured kernel, problems still

[Noino]

Eljas Alakulppi wrote : 

> 1. Are you trying to redirect traffic directed to port 53 to port 10053?  
> Use REDIRECT target.  

This is overwhelming :-(  would you (collective) be so kind as to write out 
the needed rule(s) so I can leave you to rest at last ? 

>> iptables -t nat -A OUTPUT -o lo -p udp --dport 53 -j DNAT 
>> --to-destination :10053
>> iptables: Invalid argument
> 2. DNAT requires destination IP as well.

OK, if I replace an explicit --to-destination 127.0.0.1:10053 , still I'm 
getting "Invalid argument" !
Is that diag what you would get ? I suspect my iptables may be out of sync 
with my kernel, which is why I dare reiterate my question... 

TYVM 

-- 
Noino

Re: local NAT; reconfigured kernel, problems still

[Georgi Georgiev]

maillog: 01/04/2008-11:40:14(+0200): Noino types
> Eljas Alakulppi wrote : 
>> 1. Are you trying to redirect traffic directed to port 53 to port 10053?  
>> Use REDIRECT target.  
>
> This is overwhelming :-(  would you (collective) be so kind as to write out 
> the needed rule(s) so I can leave you to rest at last ? 
>>> iptables -t nat -A OUTPUT -o lo -p udp --dport 53 -j DNAT 
>>> --to-destination :10053
>>> iptables: Invalid argument
>> 2. DNAT requires destination IP as well.
>
> OK, if I replace an explicit --to-destination 127.0.0.1:10053 , still I'm 
> getting "Invalid argument" !
> Is that diag what you would get ? I suspect my iptables may be out of sync 
> with my kernel, which is why I dare reiterate my question... 
> TYVM 

Maybe it is the "-p udp" that is causing the message. Does -j LOG
(instead of -j DNAT --to-destination) work? If it does not, then you
need to add "-m udp" in front of "-p udp".

-- 
(*   Georgi Georgiev   (* "If anything can go wrong, it will." --    (*
*)    chutz@gg3.net    *) Edsel Murphy                               *)
(* http://www.gg3.net/ (*                                            (*

Re: local NAT; reconfigured kernel, problems still

[Noino]

Georgi Georgiev writes : 

>>>> iptables -t nat -A OUTPUT -o lo -p udp --dport 53 -j DNAT 
>>>> --to-destination :10053
>>>> iptables: Invalid argument

> Maybe it is the "-p udp" that is causing the message. Does -j LOG
> (instead of -j DNAT --to-destination) work? If it does not, then you
> need to add "-m udp" in front of "-p udp".

"-j LOG" does not yield an error message; the above rule, with the addition 
of  "-m udp" gives the same error as without it. 

I think my last trial will be compiling a fresh iptables in replacement of 
the version that came with my SUSE (originally kernel was 2.6.4, updated to 
2.6.5. Maybe low level structures have changed, just a guess of course) 

Again, what version number should I be getting from the iptables archive ? 

-- 
Noino