-j DNAT doesn't accept nonnumerical port

-j DNAT doesn't accept nonnumerical port

[Marcin Mirosław]

Hello!
Iptables accept such line without problem:
iptables -t nat -A PREROUTING -p tcp  --dport pop3 -j DNAT 
--to-destination 1.2.3.4:25

Destination port is defined by word. So i wanted to use use the same 
trick in DNAT but i've got:
# iptables -t nat -A PREROUTING -p tcp  --dport pop3 -j DNAT 
--to-destination 1.2.3.4:smtp
iptables v1.4.12: Port `smtp' not valid

Is it intentional behavior of iptables? I can't see any info about it in 
man.

Regards,
Marcin

Re: -j DNAT doesn't accept nonnumerical port

[Jan Engelhardt]

On Thursday 2011-08-25 16:31, Marcin Mirosław wrote:

> Hello!
> Iptables accept such line without problem:
> iptables -t nat -A PREROUTING -p tcp  --dport pop3 -j DNAT --to-destination
> 1.2.3.4:25
>
> Destination port is defined by word. So i wanted to use use the same trick in
> DNAT but i've got:
> # iptables -t nat -A PREROUTING -p tcp  --dport pop3 -j DNAT --to-destination
> 1.2.3.4:smtp
> iptables v1.4.12: Port `smtp' not valid
>
> Is it intentional behavior of iptables? I can't see any info about it in man.

At least it is not a regression.

DNAT does not accept names currently, and I can guess this is because 
of:

Port names can contain pretty much any character except \0, so there is 
no way for DNAT, without symmetric delimiters like '[' and ']' for 
example, to know from the user specifying "smtp-imap" whether s/he means 
the single (fictional) port "smtp-imap", or the range 25--143.

Re: -j DNAT doesn't accept nonnumerical port

[Marcin Mirosław]

W dniu 26.08.2011 09:54, Jan Engelhardt pisze:
> At least it is not a regression.
>
> DNAT does not accept names currently, and I can guess this is because
> of:
>
> Port names can contain pretty much any character except \0, so there is
> no way for DNAT, without symmetric delimiters like '[' and ']' for
> example, to know from the user specifying "smtp-imap" whether s/he means
> the single (fictional) port "smtp-imap", or the range 25--143.

This is good reason :) However, it's a little misleading.
Thank you for answer.

Regards,
Marcin.