From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Det Buaklee" Subject: iptables: invalid arguement with kernel 2.6.5 Date: Tue, 4 May 2004 18:00:40 +0700 Sender: netfilter-admin@lists.netfilter.org Message-ID: <002e01c431c7$09cfe910$440997cb@GINA> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_002F_01C43201.B62EC110" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_002F_01C43201.B62EC110 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit Hi I am very new in configuring iptables with bridge software. I want to do a transparent proxy with iptables and squid and running a firewall bridge on the squid box. I have upgraded my kernel to 2.6.5 (to get the firewall-bridge) and I have already tried compiled iptables 1.2.9 with the kernel src directory. My problem is when I tried something like /sbin/iptables -A PREROUTING -t mangle -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 or /sbin/iptables -t mangle -A PREROUTING -m physdev --physdev-in eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 and iptables just return iptables: invalid argument Any help or pointer to some documents would be much appreciated. Det Buaklee ------=_NextPart_000_002F_01C43201.B62EC110 Content-Type: text/html; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable

Hi

 

I am very new in configuring iptables with = bridge software. I want to do a transparent proxy with iptables and squid and running a firewall bridge on the squid box. I have = upgraded my kernel to 2.6.5 (to get the firewall-bridge) and I have already tried = compiled iptables 1.2.9 with the kernel src directory. My problem is when I tried something like =

 

/sbin/iptables -A PREROUTING -t mangle -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

 

or

 

/sbin/iptables -t mangle -A PREROUTING -m physdev --physdev-in = eth0 -p tcp --dport 80 -j = REDIRECT --to-port 8080

 

and iptables just return =

 

iptables: invalid = argument

 

Any help or pointer to some documents would be much appreciated. =

 

Det Buaklee

------=_NextPart_000_002F_01C43201.B62EC110-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: iptables: invalid arguement with kernel 2.6.5 Date: Tue, 4 May 2004 12:33:52 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200405041233.52018.Antony@Soft-Solutions.co.uk> References: <002e01c431c7$09cfe910$440997cb@GINA> Reply-To: Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <002e01c431c7$09cfe910$440997cb@GINA> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Tuesday 04 May 2004 12:00 pm, Det Buaklee wrote: > /sbin/iptables -A PREROUTING -t mangle -i eth0 -p tcp --dport 80 -j > REDIRECT --to-port 8080 > > or > > /sbin/iptables -t mangle -A PREROUTING -m physdev --physdev-in eth0 -p > tcp --dport 80 -j REDIRECT --to-port 8080 > > and iptables just return > > iptables: invalid argument REDIRECT should be done in the nat table, not the mangle table. Antony. -- Software development can be quick, high quality, or low cost. The customer gets to pick any two out of three. Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Krystian Subject: Re: iptables: invalid arguement with kernel 2.6.5 Date: Tue, 04 May 2004 13:43:35 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <409781E7.5060301@o2.pl> References: <002e01c431c7$09cfe910$440997cb@GINA> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <002e01c431c7$09cfe910$440997cb@GINA> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Det Buaklee Cc: netfilter@lists.netfilter.org Det Buaklee wrote: > Hi > > > > I am very new in configuring iptables with bridge software. I want to > do a transparent proxy with iptables and squid and running a firewall > bridge on the squid box. I have upgraded my kernel to 2.6.5 (to get > the firewall-bridge) and I have already tried compiled iptables 1.2.9 > with the kernel src directory. My problem is when I tried something like > > > > /sbin/iptables -A PREROUTING -t mangle -i eth0 -p tcp --dport 80 -j > REDIRECT --to-port 8080 > > > > or > > > > /sbin/iptables -t mangle -A PREROUTING -m physdev --physdev-in eth0 -p > tcp --dport 80 -j REDIRECT --to-port 8080 > > > > and iptables just return > > > > iptables: invalid argument > > > > Any help or pointer to some documents would be much appreciated. > > > > Det Buaklee > bad table "mangle". try using diffrent for example nat. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sven Schuster Subject: Re: iptables: invalid arguement with kernel 2.6.5 Date: Tue, 4 May 2004 13:58:24 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20040504115824.GA5227@zion.homelinux.com> References: <002e01c431c7$09cfe910$440997cb@GINA> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="0F1p//8PRICkK4MW" Return-path: Content-Disposition: inline In-Reply-To: <002e01c431c7$09cfe910$440997cb@GINA> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Det Buaklee Cc: netfilter@lists.netfilter.org --0F1p//8PRICkK4MW Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi Det, On Tue, May 04, 2004 at 06:00:40PM +0700, Det Buaklee told us: > Hi > =20 > I am very new in configuring iptables with bridge software. I want to do > a transparent proxy with iptables and squid and running a firewall > bridge on the squid box. I have upgraded my kernel to 2.6.5 (to get the > firewall-bridge) and I have already tried compiled iptables 1.2.9 with > the kernel src directory. My problem is when I tried something like=20 > =20 > /sbin/iptables -A PREROUTING -t mangle -i eth0 -p tcp --dport 80 -j > REDIRECT --to-port 8080 > =20 > or=20 > =20 > /sbin/iptables -t mangle -A PREROUTING -m physdev --physdev-in eth0 -p > tcp --dport 80 -j REDIRECT --to-port 8080 > =20 > and iptables just return=20 > =20 > iptables: invalid argument > =20 > Any help or pointer to some documents would be much appreciated.=20 > =20 > Det Buaklee REDIRECT ist only valid in the nat table, not in mangle. HTH Sven --=20 Linux zion 2.6.6-rc1 #1 Sat Apr 17 11:50:12 CEST 2004 i686 athlon i386 GNU/= Linux 13:57:45 up 13 days, 18:47, 1 user, load average: 0.03, 0.04, 0.06 --0F1p//8PRICkK4MW Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFAl4Vgo4FAdB2PneQRArJ4AJ46No2usGb14X2CtqW8fQaXQJDc+ACeLwk8 rivqfTdMkaxhcxPwYH5vID4= =NeCV -----END PGP SIGNATURE----- --0F1p//8PRICkK4MW-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Angel Subject: Re: iptables: invalid arguement with kernel 2.6.5 Date: Tue, 4 May 2004 13:31:29 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200405041331.29315.a.alvarez@uah.es> References: <002e01c431c7$09cfe910$440997cb@GINA> Reply-To: a.alvarez@uah.es Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <002e01c431c7$09cfe910$440997cb@GINA> Content-Disposition: inline Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="johab" To: netfilter@lists.netfilter.org on the mangle table?=20 i think it should be on the nat table? El Martes, 4 de Mayo de 2004 13:00, Det Buaklee escribi=C3=B3: > Hi > > I am very new in configuring iptables with bridge software. I want to do > a transparent proxy with iptables and squid and running a firewall > bridge on the squid box. I have upgraded my kernel to 2.6.5 (to get the > firewall-bridge) and I have already tried compiled iptables 1.2.9 with > the kernel src directory. My problem is when I tried something like > > /sbin/iptables -A PREROUTING -t mangle -i eth0 -p tcp --dport 80 -j > REDIRECT --to-port 8080 > > or > > /sbin/iptables -t mangle -A PREROUTING -m physdev --physdev-in eth0 -p > tcp --dport 80 -j REDIRECT --to-port 8080 > > and iptables just return > > iptables: invalid argument > > Any help or pointer to some documents would be much appreciated. > > Det Buaklee =2D-=20 =2D------------------------------------------------------- Angel J. Alvarez Miguel Secci=C3=B3n de Sistemas, Servicio de Explotaci=C3=B3n Servicios Informaticos, Universidad de Alcal=C3=A1 Tfno: +34 91 885 47 04, Fax: +34 91 885 51 11 =2D------------------------------------------------------- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Det Buaklee" Subject: RE: iptables: invalid arguement with kernel 2.6.5 Date: Tue, 4 May 2004 19:13:30 +0700 Sender: netfilter-admin@lists.netfilter.org Message-ID: <004d01c431d1$36b194b0$440997cb@GINA> References: <200405041233.52018.Antony@Soft-Solutions.co.uk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200405041233.52018.Antony@Soft-Solutions.co.uk> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org Thanks guys for pointing out, though I am still confused with the different between -t nat and -t mangle (on the bridge, and I am not doing NAT on my network what options should I use) .. I think am going to read the man page more carefully.. DET -----Original Message----- From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Antony Stone Sent: Tuesday, May 04, 2004 6:34 PM To: netfilter@lists.netfilter.org Subject: Re: iptables: invalid arguement with kernel 2.6.5 On Tuesday 04 May 2004 12:00 pm, Det Buaklee wrote: > /sbin/iptables -A PREROUTING -t mangle -i eth0 -p tcp --dport 80 -j > REDIRECT --to-port 8080 > > or > > /sbin/iptables -t mangle -A PREROUTING -m physdev --physdev-in eth0 -p > tcp --dport 80 -j REDIRECT --to-port 8080 > > and iptables just return > > iptables: invalid argument REDIRECT should be done in the nat table, not the mangle table. Antony. -- Software development can be quick, high quality, or low cost. The customer gets to pick any two out of three. Please reply to the list; please don't CC me.