From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Mohammad Shakir" Subject: Need Help Date: Fri, 27 Sep 2002 11:08:47 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: Mime-Version: 1.0 Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/html; charset="windows-1252" Content-Transfer-Encoding: quoted-printable To: netfilter@lists.samba.org

Dear Russell,

I have this setup in ipchains and now I want to convert in iptables. p= lz help me.

/sbin/ipchains -F forward

/sbin/ipchains -F input

/sbin/ipchains -F output

/sbin/ipchains -P forward   ACCEPT
/sbin/ipchains&n= bsp; -P input     ACCEPT
/sbin/ipchains -P out= put    ACCEPT

echo "1" > /proc/sys/net/ipv4/ip_forward

# for transparent proxy
/sbin/ipchains -A input -j REDIRECT 8080 -p= tcp -s 0.0.0.0/0 -d 0.0.0.0/0 80

# for direct connection excluding HTTP
/sbin/ipchains -A forw= ard -j -p all -s 0.0.0.0/0 -d 0.0.0.0/0

It was my old setup in RedHat Linux 7.0Rel.

Now I have installed new verions of RedHat Linux 7.2, with Kernel 2.4.= 7-10 and iptables version 1.2.3.

thanks in advance

shakir

Join the world=92s largest = e-mail service with MSN Hotmail. Click Here
From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Davide" Subject: Re: Need Help Date: Mon, 30 Sep 2002 00:26:12 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <002601c26807$3c41cc00$5120a8c0@mmx> References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0023_01C26817.FAF9B300" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Mohammad Shakir , netfilter@lists.samba.org This is a multi-part message in MIME format. ------=_NextPart_000_0023_01C26817.FAF9B300 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable hello, this is the iptables version /sbin/iptables -F=20 /sbin/iptables -t nat -F=20 =20 /sbin/iptables -P INPUT ACCEPT /sbin/iptables -P FORWARD ACCEPT /sbin/iptables -P OUTPUT ACCEPT echo "1" > /proc/sys/net/ipv4/ip_forward # for trasparent proxy /sbin/iptables -t nat -A PREROUTING -p tcp -s 0.0.0.0/0 --dport 80 -j = REDIRECT --to-ports 8080 # for direct connection excluding HTTP /sbin/iptables -A FORWARD -p tcp -s 0.0.0.0/0 --dport 80 -j DROP =20 Davide ----- Original Message -----=20 From: Mohammad Shakir=20 To: netfilter@lists.samba.org=20 Sent: Friday, September 27, 2002 1:08 PM Subject: Need Help Dear Russell, I have this setup in ipchains and now I want to convert in iptables. = plz help me.=20 /sbin/ipchains -F forward =20 /sbin/ipchains -F input =20 /sbin/ipchains -F output =20 /sbin/ipchains -P forward ACCEPT /sbin/ipchains -P input ACCEPT /sbin/ipchains -P output ACCEPT echo "1" > /proc/sys/net/ipv4/ip_forward # for transparent proxy /sbin/ipchains -A input -j REDIRECT 8080 -p tcp -s 0.0.0.0/0 -d = 0.0.0.0/0 80 # for direct connection excluding HTTP /sbin/ipchains -A forward -j -p all -s 0.0.0.0/0 -d 0.0.0.0/0 It was my old setup in RedHat Linux 7.0Rel. Now I have installed new verions of RedHat Linux 7.2, with Kernel = 2.4.7-10 and iptables version 1.2.3. thanks in advance=20 shakir=20 -------------------------------------------------------------------------= ----- Join the world's largest e-mail service with MSN Hotmail. Click Here ------=_NextPart_000_0023_01C26817.FAF9B300 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

hello,

this is the iptables=20 version

/sbin/iptables -F

/sbin/iptables -t = nat -F

/sbin/iptables -P INPUT = ACCEPT

/sbin/iptables -P FORWARD = ACCEPT

/sbin/iptables -P OUTPUT = ACCEPT

echo "1" > /proc/sys/net/ipv4/ip_forward

# for trasparent proxy

/sbin/iptables -t nat -A PREROUTING -p = tcp -s=20 0.0.0.0/0 --dport 80 -j REDIRECT --to-ports 8080

# for direct=20 connection excluding HTTP
/sbin/iptables -A FORWARD -p tcp -s 0.0.0.0/0 --dport 80 -j=20 DROP

Davide

----- Original Message -----

From:=20 Mohammad=20 Shakir

To: netfilter@lists.samba.org =

Sent: Friday, September 27, = 2002 1:08=20 PM

Subject: Need Help

Dear Russell,

I have this setup in ipchains and now I want to convert in = iptables. plz=20 help me.

/sbin/ipchains -F forward

/sbin/ipchains -F input

/sbin/ipchains -F output

/sbin/ipchains -P forward  =20 ACCEPT
/sbin/ipchains -P input    =20 ACCEPT
/sbin/ipchains -P output    = ACCEPT

echo=20 "1" > /proc/sys/net/ipv4/ip_forward

# for transparent proxy
/sbin/ipchains -A input -j REDIRECT = 8080 -p=20 tcp -s 0.0.0.0/0 -d 0.0.0.0/0 80

# for direct connection excluding HTTP
/sbin/ipchains -A = forward=20 -j -p all -s 0.0.0.0/0 -d 0.0.0.0/0

It was my old setup in RedHat Linux 7.0Rel.

Now I have installed new verions of RedHat Linux 7.2, with Kernel = 2.4.7-10 and iptables version 1.2.3.

thanks in advance

shakir

Join the world=92s largest e-mail service with MSN Hotmail. Click=20 Here
------=_NextPart_000_0023_01C26817.FAF9B300-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: Need Help Date: Sun, 29 Sep 2002 23:40:36 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20020929224039.UBRU2092.mta07-svc.ntlworld.com@there> References: <002601c26807$3c41cc00$5120a8c0@mmx> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <002601c26807$3c41cc00$5120a8c0@mmx> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Sunday 29 September 2002 11:26 pm, Davide wrote: > hello, > this is the iptables version > > /sbin/iptables -F > /sbin/iptables -t nat -F > > /sbin/iptables -P INPUT ACCEPT Ugh. > /sbin/iptables -P FORWARD ACCEPT Ughhh !!! > /sbin/iptables -P OUTPUT ACCEPT > > echo "1" > /proc/sys/net/ipv4/ip_forward It's a good idea to put this *after* your rules, to avoid any period of time when the kernel's forwarding packets, but without a ruleset loaded... > # for trasparent proxy > /sbin/iptables -t nat -A PREROUTING -p tcp -s 0.0.0.0/0 --dport 80 -j > REDIRECT --to-ports 8080 The -s 0.0.0.0/0 is redundant. > # for direct connection excluding HTTP > /sbin/iptables -A FORWARD -p tcp -s 0.0.0.0/0 --dport 80 -j DROP Please do this as an explicit ACCEPT rule for *outbound* packets which do not match HTTP, and have a default DROP policy on the FORWARD chain (so you block anything trying to come in). ie: iptables -P FORWARD DROP iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p tcp --dport ! 80 -o $extIF -j ACCEPT Antony. -- G- GIT/E d- s+:--(-) a+ C++++$ UL++++$ P+(---)>++ L+++(++++)$ !E W(-) N(-) o? w-- O !M V+++(--) !PS !PE Y+ PGP+> t- tv@ b+++ DI++ D--- e++>+++ h++ r@? 5? !X- !R K--? From mboxrd@z Thu Jan 1 00:00:00 1970 From: Karthik RC Subject: need help Date: Tue, 29 Apr 2003 10:21:45 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3EAE5239.3080605@naturesoft.net> Reply-To: karthikeyan-rc@naturesoft.net Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@lists.netfilter.org Hello , can we do IP/MAC filering through iptables.. regards from karthik From mboxrd@z Thu Jan 1 00:00:00 1970 From: "hare ram" Subject: Re: need help Date: Tue, 29 Apr 2003 12:13:28 +0530 Sender: netfilter-admin@lists.netfilter.org Message-ID: <00ee01c30e1a$a65da780$13fcc5cb@Housecall> References: <3EAE5239.3080605@naturesoft.net> Reply-To: "hare ram" Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: karthikeyan-rc@naturesoft.net, netfilter@lists.netfilter.org Hi Yes you can do MAC address based Filter using Iptables hare ----- Original Message ----- From: "Karthik RC" To: Sent: Tuesday, April 29, 2003 3:51 PM Subject: need help > Hello , > can we do IP/MAC filering through iptables.. > regards > from karthik > > > From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Julius Wijaya" Subject: Re: need help Date: Tue, 29 Apr 2003 14:35:08 +0700 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200304291435080189.013CC15F@smtp.nikonbw.com> References: <3EAE5239.3080605@naturesoft.net> Reply-To: wijayaj@gmx.net Content-Type: text/plain; charset="us-ascii" Return-path: In-Reply-To: <3EAE5239.3080605@naturesoft.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit To: karthikeyan-rc@naturesoft.net, netfilter@lists.netfilter.org You can use MAC match option example: IPTABLES -A INPUT -m mac --mac-source 00:00:00:00:01:11 regards. JW *********** REPLY SEPARATOR *********** On 29/04/2003 at 10:21 AM Karthik RC wrote: >Hello , > can we do IP/MAC filering through iptables.. >regards >from karthik From mboxrd@z Thu Jan 1 00:00:00 1970 From: Maciej Soltysiak Subject: Re: need help Date: Tue, 29 Apr 2003 11:27:50 +0200 (CEST) Sender: netfilter-admin@lists.netfilter.org Message-ID: References: <3EAE5239.3080605@naturesoft.net> Mime-Version: 1.0 Return-path: In-Reply-To: <3EAE5239.3080605@naturesoft.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: TEXT/PLAIN; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Karthik RC Cc: netfilter@lists.netfilter.org > Hello , > can we do IP/MAC filering through iptables.. Yes, you can match the source/destination IP address and/or source MAC address. Examples: # iptables -A FORWARD -s 10.20.30.40 -j REJECT # iptables -A OUTPUT -d 10.12.13.14 -j LOG # iptables -A FORWARD -m mac --mac-source 00:01:23:45:67:89 -j ACCEPT # iptables -A FORWARD -m mac --mac-source ! 00:01:23:45:67:89 -j REJECT Please read # iptables -m mac --help # iptables --help And whatever comes to your mind, the modules have their own help messages. # iptables -p tcp --help # iptables -m state --help etc... Regards, Maciej From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matt Robineau Subject: need help Date: Fri, 16 Apr 2004 14:28:23 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <408025C7.2030202@onlink.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@lists.netfilter.org I need help getting my rules working, I get an error: iptables: No chain/target/match by that name But it should work. I read how to do it in an online tutorial and it wont work for me, it keeps giving me this error. -- Public key for 0xD0EFD89C8CFD173F -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.2.3 (GNU/Linux) mQGiBEA24CARBACxU0e78VOHXihesMeLogGq06Te13S2CGNubw9pndutegtauxm2 y76Wxal4tUh37sp1n9Nkr0arG1hZ7FDhxibAJ75b0zxHag9N2EYKAesE0iq7VIa3 FuGgpnmyEKogJ0PRJrzAMFcFFffdQliGtqSX5aVNSCHEyjfyVcyPAtFhhwCg8Pc7 z+yEWEV3DEuveMzqVYaKjs8D/1GSpmY8zC5jQ9/CM3RMrJyGlJWbcGA6XEoSUFui oppM5OvkFrt1FYapHWiE3O6Jk3nKHiEHMRx3lCyilWilCLqsuOEMHVDmD63Rk2v9 rawSdZqzdIbFz4KoTV+BZkXT/IRkaByo37aDkHkMD0+rdPtL3Cof7ZsWEbqLi3sl uflyA/wMCgG8N8AnZr6yDuIlraI+G2TsY8r2x4nAwMNYD3aBxgNq923uAWzLIa/S CskTTxvqXBFj0dVdCSmsUzBUXkS+l4uT9WD1fiYeKUB10pZMppDfNIu2c/v1wbaA 7WMXvzEugoEbtFj0vNpZHZbjFadKtTfXwV+4A7P1Nj2qsXAScLRlTWF0dCBSb2Jp bmVhdSAoQ3Jvc3MgdGhlIHJpdmVyIGFuZCBkZXN0cm95IHRoZSBicmlkZ2UuIFZp Y3RvcnkgbGllcyBpbiBkZWNlcHRpb24uKSA8dmV4ZXJAb25saW5rLm5ldD6IXgQT EQIAHgUCQDbgIAIbAwYLCQgHAwIDFQIDAxYCAQIeAQIXgAAKCRDQ79icjP0XPxon AKC3OhTMT+P6/BGlk/lhllOhq3emQQCgshhdRcosDD2YZVAxnoDCQTEpy965AQ0E QDbgIRAEALq7W395qkQs7yAK18DGAqH1PHvMlBWxw8o1JvcAfrO5nQZbtnteDAmG 8BWsxP9IXYIeSuVbNG9VCSlhWZfQtjoTzQH5s8UqUpjara9pBkjDoiTN/RNfNwVp DriQ1VQjvPv9gH8c29mepHepg+VZV7GuZ0rlF7mjxc5gZSMpgsJ3AAMFA/9OKBL8 hWkDFEyDqgJf9vpHX7ROQfWTS8jxI0+c3rXped3zo8C/keso2g2G28zViqewePHs acenD72g8CCjUghtlthaFc5pKP8ohUt7f6QWAHcPKi8SrQCxtmRf0xdgg1tzAeGh EZ5ebB7RsE1J4HYuWodOAwSbPnwGj4xKSNFlAYhJBBgRAgAJBQJANuAhAhsMAAoJ ENDv2JyM/Rc/SxAAoNiZTWuCDqhshd4O5C0YzKkZdvIVAKDoliGHP3UaPPOumkh9 51V2n66yQg== =/Mfp -----END PGP PUBLIC KEY BLOCK----- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: need help Date: Fri, 16 Apr 2004 20:26:21 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200404162026.21955.Antony@Soft-Solutions.co.uk> References: <408025C7.2030202@onlink.net> Reply-To: netfilter@lists.netfilter.org Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <408025C7.2030202@onlink.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Friday 16 April 2004 7:28 pm, Matt Robineau wrote: > I need help getting my rules working, I get an error: iptables: No > chain/target/match by that name > > But it should work. I read how to do it in an online tutorial and it > wont work for me, it keeps giving me this error. It doesn't like one of the words you typed in the command you entered. Since you didn't tell us what the command was, I can't tell you which word it was, but hopefully this is enough of a clue for you to work out the problem. Regards, Antony. -- People who use Microsoft software should be certified. Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Khanh Tran" Subject: RE: need help Date: Fri, 16 Apr 2004 15:17:48 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <01CEA3A5B8B2D511890F0002A5870AEC027C1D47@exchange.admin.slc.edu> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Matt Robineau , netfilter@lists.netfilter.org The rule that generates that error would help.... Khanh Tran Network Operations Sarah Lawrence College 1 Mead Way Bronxville, NY 10708 =20 -----Original Message----- From: Matt Robineau [mailto:vexer@onlink.net]=20 Sent: Friday, April 16, 2004 2:28 PM To: netfilter@lists.netfilter.org Subject: need help I need help getting my rules working, I get an error: iptables: No chain/target/match by that name But it should work. I read how to do it in an online tutorial and it wont work for me, it keeps giving me this error. -- Public key for 0xD0EFD89C8CFD173F -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.2.3 (GNU/Linux) mQGiBEA24CARBACxU0e78VOHXihesMeLogGq06Te13S2CGNubw9pndutegtauxm2 y76Wxal4tUh37sp1n9Nkr0arG1hZ7FDhxibAJ75b0zxHag9N2EYKAesE0iq7VIa3 FuGgpnmyEKogJ0PRJrzAMFcFFffdQliGtqSX5aVNSCHEyjfyVcyPAtFhhwCg8Pc7 z+yEWEV3DEuveMzqVYaKjs8D/1GSpmY8zC5jQ9/CM3RMrJyGlJWbcGA6XEoSUFui oppM5OvkFrt1FYapHWiE3O6Jk3nKHiEHMRx3lCyilWilCLqsuOEMHVDmD63Rk2v9 rawSdZqzdIbFz4KoTV+BZkXT/IRkaByo37aDkHkMD0+rdPtL3Cof7ZsWEbqLi3sl uflyA/wMCgG8N8AnZr6yDuIlraI+G2TsY8r2x4nAwMNYD3aBxgNq923uAWzLIa/S CskTTxvqXBFj0dVdCSmsUzBUXkS+l4uT9WD1fiYeKUB10pZMppDfNIu2c/v1wbaA 7WMXvzEugoEbtFj0vNpZHZbjFadKtTfXwV+4A7P1Nj2qsXAScLRlTWF0dCBSb2Jp bmVhdSAoQ3Jvc3MgdGhlIHJpdmVyIGFuZCBkZXN0cm95IHRoZSBicmlkZ2UuIFZp Y3RvcnkgbGllcyBpbiBkZWNlcHRpb24uKSA8dmV4ZXJAb25saW5rLm5ldD6IXgQT EQIAHgUCQDbgIAIbAwYLCQgHAwIDFQIDAxYCAQIeAQIXgAAKCRDQ79icjP0XPxon AKC3OhTMT+P6/BGlk/lhllOhq3emQQCgshhdRcosDD2YZVAxnoDCQTEpy965AQ0E QDbgIRAEALq7W395qkQs7yAK18DGAqH1PHvMlBWxw8o1JvcAfrO5nQZbtnteDAmG 8BWsxP9IXYIeSuVbNG9VCSlhWZfQtjoTzQH5s8UqUpjara9pBkjDoiTN/RNfNwVp DriQ1VQjvPv9gH8c29mepHepg+VZV7GuZ0rlF7mjxc5gZSMpgsJ3AAMFA/9OKBL8 hWkDFEyDqgJf9vpHX7ROQfWTS8jxI0+c3rXped3zo8C/keso2g2G28zViqewePHs acenD72g8CCjUghtlthaFc5pKP8ohUt7f6QWAHcPKi8SrQCxtmRf0xdgg1tzAeGh EZ5ebB7RsE1J4HYuWodOAwSbPnwGj4xKSNFlAYhJBBgRAgAJBQJANuAhAhsMAAoJ ENDv2JyM/Rc/SxAAoNiZTWuCDqhshd4O5C0YzKkZdvIVAKDoliGHP3UaPPOumkh9 51V2n66yQg=3D=3D =3D/Mfp -----END PGP PUBLIC KEY BLOCK----- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Brad Knorr Subject: Need help Date: Mon, 25 Oct 2021 21:53:13 -0700 Message-ID: Mime-Version: 1.0 Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=knorrfamily-org.20210112.gappssmtp.com; s=20210112; h=from:mime-version:thread-index:date:message-id:subject:to; bh=bIdNLYyl7MufDe7cvKRezWIN28r0GiYIkpKZSPSo1/0=; b=U+Nv1UPosRjMSzEmodUO87ov+xKl7nhddhEdsbARLSfT0vwsXmEnHpOSSgzWFVKGeO 6rSX3HFDoPigHDofhW9DPb5GARrc3fUW1fT+wN1gFyWLrlnhesMxcZT89jK8tKzCMXZy 9ccDXn1R0RmBRyw8zXqIDFcpBUEGv5X3ic9q6OKUr944DZgmTvZS05FNY55YfU+xkEEh JmPJkIF4RRort1HtmFnR8YWoT1ZgY/pv8Gv6+vqWAWlTfQoH+rAl83pA+ggkCZvibOKi dcQjMScE7D77XMO7nHbOriJi/QHu5Bz7QLS8gByZK0XFOltz/UGGwuAyGFP6GOeM6Op1 cxZw== List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@vger.kernel.org I am new to nft commands. I wish to use the map feature for port forwarding. What I want to achieve is the following Sftp incoming to port 2222 on the public IP to be port forwarded to private IP on port 22. So what I found in the docs is this. % nft add map nat foo { type inet_service : ipv4_addr . inet_service \; } % nft add element nat foo { \ 1100 : 192.168.1.2 . 5061, \ 1101 : 192.168.1.3 . 5061, \ 1400 : 192.168.1.4 . 5061 \ } % nft add rule nat pre ip protocol tcp dnat ip addr . port to tcp dport map @foo So when I issue the first command I get the following error: Error: unqualified mapping data type specified in map definition When I issue the command: nft add map nat foo { type inet_service : ipv4_addr \; } It works just fine. I am at a loss as to why this is happening. The reason I need the mapping is I need to add and remove port forwarding rules easily with a simple command. Any help would be greatly appreciated. Brad From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel Subject: Re: Need help Date: Tue, 26 Oct 2021 09:14:07 +0200 Message-ID: <147618b6-d98f-9413-61e1-e3e9b488344d@tootai.net> References: Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=tootai.net; s=mail; t=1635232448; bh=K4/qBe0TUQzq9fZkDm6VBlcHkdSosITflB8DrPxoFC8=; h=Subject:To:References:From:Date:In-Reply-To:From; b=azceVCT5akF7dXZOkKPHMqTE+TESfUDl6VDDAa4/X16QOqNqBoO7B3J7bhbrSN5Dy Atd5voSeJPTn9xGTLSAEvu+F+cg8s9iBZy0sd4nmAQRQxdotZYacvchOR3Csjf4iRK cdf/mPM9VNyJXZqmxw4wZs13p5wev5kekVqQMQXY= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=tootai.net; s=mail; t=1635232447; bh=K4/qBe0TUQzq9fZkDm6VBlcHkdSosITflB8DrPxoFC8=; h=Subject:To:References:From:Date:In-Reply-To:From; b=pILlyKFc3viVSO5ieDzKIj4QdEcc0V1rgGtMOGwN2FTwHqsQu83vbjSbFee03Krhn pFPxhQtm2m/YVvRA+fV8QX3GrS8yQTddmDoCt3XEk38jJf2O7oaAI9GrqLKmh8sK/A 8/nrx5eb818B/Y41aJ2K89ohgHemnq4/L8K2f7vc= In-Reply-To: Content-Language: fr-FR List-ID: Content-Type: text/plain; charset="utf-8"; format="flowed" To: netfilter@vger.kernel.org Hello Brad Le 26/10/2021 à 06:53, Brad Knorr a écrit : > I am new to nft commands. I wish to use the map feature for port > forwarding. What I want to achieve is the following > > Sftp incoming to port 2222 on the public IP to be port forwarded to > private IP on port 22. So what I found in the docs is this. > > % nft add map nat foo { type inet_service : ipv4_addr . inet_service \; } > > % nft add element nat foo { \ > 1100 : 192.168.1.2 . 5061, \ > 1101 : 192.168.1.3 . 5061, \ > 1400 : 192.168.1.4 . 5061 \ > } > % nft add rule nat pre ip protocol tcp dnat ip addr . port to tcp dport > map @foo > > > So when I issue the first command I get the following error: > Error: unqualified mapping data type specified in map definition > > When I issue the command: nft add map nat foo { type inet_service : > ipv4_addr \; } > > It works just fine. I am at a loss as to why this is happening. The > reason I need the mapping is I need to add and remove port forwarding > rules easily with a simple command. > > Any help would be greatly appreciated. > Brad % nft add map nat foo { type inet_service : ipv4_addr \; flags interval \; } should do the job -- Daniel