iptables -t nat -A OUTPUT - j DNAT

iptables -t nat -A OUTPUT - j DNAT

[Leszek Żur]

Hello all.

Slackware 9.0
kernel 2.4.20
iptables 1.2.7a

iptables -t nat -A OUTPUT -d 1.1.1.1 -j DNAT --to-destination 2.2.2.2
iptables: Invalid argument

From iptables manual:
   DNAT
       This  target  is  only valid in the nat table, in the PREROUTING and
OUTPUT chains,
       and user-defined chains which are only called from those chains.  It
specifies that
       the destination address of the packet should be modified (and all
future packets in
       this connection will also be mangled), and rules should cease being
examined.   It
       takes one type of option:

       --to-destination ipaddr[-ipaddr][:port-port]
              which can specify a single new destination IP address, an
inclusive range of
              IP addresses, and optionally, a port range (which is only
valid if the  rule
              also  specifies  -p tcp or -p udp).  If no port range is
specified, then the
              destination port will never be modified.



anybody can help me ??

Re: iptables -t nat -A OUTPUT - j DNAT

[Cedric Blancher]

Le ven 23/05/2003 à 16:41, Leszek Żur a écrit :
> Slackware 9.0
> kernel 2.4.20
> iptables 1.2.7a
> iptables -t nat -A OUTPUT -d 1.1.1.1 -j DNAT --to-destination 2.2.2.2
> iptables: Invalid argument

Strange, works fine for me :

cbr@elendil:~$ sudo iptables --version
iptables v1.2.7a
cbr@elendil:~$ sudo iptables -t nat -A OUTPUT -d 1.1.1.1 -j DNAT
	--to-destination 2.2.2.2
cbr@elendil:~$ sudo iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
 
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
 
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DNAT       all  --  anywhere             1.1.1.1            to:2.2.2.2

Are both kernel and iptables Slackware packages ? Are they built from
sources ? If so, does patch-o-matic have been applied (pending and
submitted) ?

I got problems like this when I was used to build my own kernel and use
an iptables package from distro.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
IT systems and networks security - Cartel Sécurité
Phone : +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

RE: iptables -t nat -A OUTPUT - j DNAT

[George Vieira]

this usually means you did not compile the patch-o-matic patch to fix the OUTPUT bug. Can you check this and make sure it's done as it's not default (for some weird resason)..

-----Original Message-----
From: Leszek Zur [mailto:lzur@record.com.pl]
Sent: Saturday, May 24, 2003 12:41 AM
To: netfilter@lists.netfilter.org
Subject: iptables -t nat -A OUTPUT - j DNAT 


Hello all.

Slackware 9.0
kernel 2.4.20
iptables 1.2.7a

iptables -t nat -A OUTPUT -d 1.1.1.1 -j DNAT --to-destination 2.2.2.2
iptables: Invalid argument

From iptables manual:
   DNAT
       This  target  is  only valid in the nat table, in the PREROUTING and
OUTPUT chains,
       and user-defined chains which are only called from those chains.  It
specifies that
       the destination address of the packet should be modified (and all
future packets in
       this connection will also be mangled), and rules should cease being
examined.   It
       takes one type of option:

       --to-destination ipaddr[-ipaddr][:port-port]
              which can specify a single new destination IP address, an
inclusive range of
              IP addresses, and optionally, a port range (which is only
valid if the  rule
              also  specifies  -p tcp or -p udp).  If no port range is
specified, then the
              destination port will never be modified.



anybody can help me ??