Need help

Need help

[Brad Knorr]

I am new to nft commands.  I wish to use the map feature for port
forwarding.  What I want to achieve is the following

Sftp  incoming  to port 2222 on the public IP to be port forwarded to
private IP on port 22.  So what I found in the docs is this.

% nft add map nat foo { type inet_service : ipv4_addr . inet_service \; }

% nft add element nat foo { \
    1100 : 192.168.1.2 . 5061, \
    1101 : 192.168.1.3 . 5061, \
    1400 : 192.168.1.4 . 5061 \
}
% nft add rule nat pre ip protocol tcp dnat ip addr . port to tcp dport
map @foo


So when I issue the first command I get the following error:
Error: unqualified mapping data type specified in map definition

When I issue the command:  nft add map nat foo { type inet_service :
ipv4_addr \; }

It works just fine.  I am at a loss as to why this is happening.  The
reason I need the mapping is I need to add and remove port forwarding
rules easily with a simple command.

Any help would be greatly appreciated.
Brad

Re: Need help

[Daniel]

Hello Brad

Le 26/10/2021 à 06:53, Brad Knorr a écrit :
> I am new to nft commands.  I wish to use the map feature for port
> forwarding.  What I want to achieve is the following
>
> Sftp  incoming  to port 2222 on the public IP to be port forwarded to
> private IP on port 22.  So what I found in the docs is this.
>
> % nft add map nat foo { type inet_service : ipv4_addr . inet_service \; }
>
> % nft add element nat foo { \
>      1100 : 192.168.1.2 . 5061, \
>      1101 : 192.168.1.3 . 5061, \
>      1400 : 192.168.1.4 . 5061 \
> }
> % nft add rule nat pre ip protocol tcp dnat ip addr . port to tcp dport
> map @foo
>
>
> So when I issue the first command I get the following error:
> Error: unqualified mapping data type specified in map definition
>
> When I issue the command:  nft add map nat foo { type inet_service :
> ipv4_addr \; }
>
> It works just fine.  I am at a loss as to why this is happening.  The
> reason I need the mapping is I need to add and remove port forwarding
> rules easily with a simple command.
>
> Any help would be greatly appreciated.
> Brad

% nft add map nat foo { type inet_service : ipv4_addr \; flags interval \; } should do the job

-- 
Daniel

RE: need help

[Khanh Tran]

The rule that generates that error would help....


Khanh Tran
Network Operations
Sarah Lawrence College
1 Mead Way
Bronxville, NY 10708
 

-----Original Message-----
From: Matt Robineau [mailto:vexer@onlink.net] 
Sent: Friday, April 16, 2004 2:28 PM
To: netfilter@lists.netfilter.org
Subject: need help

I need help getting my rules working, I get an error: iptables: No
chain/target/match by that name

But it should work. I read how to do it in an online tutorial and it
wont work for me, it keeps giving me this error.

--
Public key for 0xD0EFD89C8CFD173F
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.2.3 (GNU/Linux)

mQGiBEA24CARBACxU0e78VOHXihesMeLogGq06Te13S2CGNubw9pndutegtauxm2
y76Wxal4tUh37sp1n9Nkr0arG1hZ7FDhxibAJ75b0zxHag9N2EYKAesE0iq7VIa3
FuGgpnmyEKogJ0PRJrzAMFcFFffdQliGtqSX5aVNSCHEyjfyVcyPAtFhhwCg8Pc7
z+yEWEV3DEuveMzqVYaKjs8D/1GSpmY8zC5jQ9/CM3RMrJyGlJWbcGA6XEoSUFui
oppM5OvkFrt1FYapHWiE3O6Jk3nKHiEHMRx3lCyilWilCLqsuOEMHVDmD63Rk2v9
rawSdZqzdIbFz4KoTV+BZkXT/IRkaByo37aDkHkMD0+rdPtL3Cof7ZsWEbqLi3sl
uflyA/wMCgG8N8AnZr6yDuIlraI+G2TsY8r2x4nAwMNYD3aBxgNq923uAWzLIa/S
CskTTxvqXBFj0dVdCSmsUzBUXkS+l4uT9WD1fiYeKUB10pZMppDfNIu2c/v1wbaA
7WMXvzEugoEbtFj0vNpZHZbjFadKtTfXwV+4A7P1Nj2qsXAScLRlTWF0dCBSb2Jp
bmVhdSAoQ3Jvc3MgdGhlIHJpdmVyIGFuZCBkZXN0cm95IHRoZSBicmlkZ2UuIFZp
Y3RvcnkgbGllcyBpbiBkZWNlcHRpb24uKSA8dmV4ZXJAb25saW5rLm5ldD6IXgQT
EQIAHgUCQDbgIAIbAwYLCQgHAwIDFQIDAxYCAQIeAQIXgAAKCRDQ79icjP0XPxon
AKC3OhTMT+P6/BGlk/lhllOhq3emQQCgshhdRcosDD2YZVAxnoDCQTEpy965AQ0E
QDbgIRAEALq7W395qkQs7yAK18DGAqH1PHvMlBWxw8o1JvcAfrO5nQZbtnteDAmG
8BWsxP9IXYIeSuVbNG9VCSlhWZfQtjoTzQH5s8UqUpjara9pBkjDoiTN/RNfNwVp
DriQ1VQjvPv9gH8c29mepHepg+VZV7GuZ0rlF7mjxc5gZSMpgsJ3AAMFA/9OKBL8
hWkDFEyDqgJf9vpHX7ROQfWTS8jxI0+c3rXped3zo8C/keso2g2G28zViqewePHs
acenD72g8CCjUghtlthaFc5pKP8ohUt7f6QWAHcPKi8SrQCxtmRf0xdgg1tzAeGh
EZ5ebB7RsE1J4HYuWodOAwSbPnwGj4xKSNFlAYhJBBgRAgAJBQJANuAhAhsMAAoJ
ENDv2JyM/Rc/SxAAoNiZTWuCDqhshd4O5C0YzKkZdvIVAKDoliGHP3UaPPOumkh9
51V2n66yQg==
=/Mfp
-----END PGP PUBLIC KEY BLOCK-----

need help

[Matt Robineau]

I need help getting my rules working, I get an error: iptables: No 
chain/target/match by that name

But it should work. I read how to do it in an online tutorial and it 
wont work for me, it keeps giving me this error.

-- 
Public key for 0xD0EFD89C8CFD173F
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.2.3 (GNU/Linux)

mQGiBEA24CARBACxU0e78VOHXihesMeLogGq06Te13S2CGNubw9pndutegtauxm2
y76Wxal4tUh37sp1n9Nkr0arG1hZ7FDhxibAJ75b0zxHag9N2EYKAesE0iq7VIa3
FuGgpnmyEKogJ0PRJrzAMFcFFffdQliGtqSX5aVNSCHEyjfyVcyPAtFhhwCg8Pc7
z+yEWEV3DEuveMzqVYaKjs8D/1GSpmY8zC5jQ9/CM3RMrJyGlJWbcGA6XEoSUFui
oppM5OvkFrt1FYapHWiE3O6Jk3nKHiEHMRx3lCyilWilCLqsuOEMHVDmD63Rk2v9
rawSdZqzdIbFz4KoTV+BZkXT/IRkaByo37aDkHkMD0+rdPtL3Cof7ZsWEbqLi3sl
uflyA/wMCgG8N8AnZr6yDuIlraI+G2TsY8r2x4nAwMNYD3aBxgNq923uAWzLIa/S
CskTTxvqXBFj0dVdCSmsUzBUXkS+l4uT9WD1fiYeKUB10pZMppDfNIu2c/v1wbaA
7WMXvzEugoEbtFj0vNpZHZbjFadKtTfXwV+4A7P1Nj2qsXAScLRlTWF0dCBSb2Jp
bmVhdSAoQ3Jvc3MgdGhlIHJpdmVyIGFuZCBkZXN0cm95IHRoZSBicmlkZ2UuIFZp
Y3RvcnkgbGllcyBpbiBkZWNlcHRpb24uKSA8dmV4ZXJAb25saW5rLm5ldD6IXgQT
EQIAHgUCQDbgIAIbAwYLCQgHAwIDFQIDAxYCAQIeAQIXgAAKCRDQ79icjP0XPxon
AKC3OhTMT+P6/BGlk/lhllOhq3emQQCgshhdRcosDD2YZVAxnoDCQTEpy965AQ0E
QDbgIRAEALq7W395qkQs7yAK18DGAqH1PHvMlBWxw8o1JvcAfrO5nQZbtnteDAmG
8BWsxP9IXYIeSuVbNG9VCSlhWZfQtjoTzQH5s8UqUpjara9pBkjDoiTN/RNfNwVp
DriQ1VQjvPv9gH8c29mepHepg+VZV7GuZ0rlF7mjxc5gZSMpgsJ3AAMFA/9OKBL8
hWkDFEyDqgJf9vpHX7ROQfWTS8jxI0+c3rXped3zo8C/keso2g2G28zViqewePHs
acenD72g8CCjUghtlthaFc5pKP8ohUt7f6QWAHcPKi8SrQCxtmRf0xdgg1tzAeGh
EZ5ebB7RsE1J4HYuWodOAwSbPnwGj4xKSNFlAYhJBBgRAgAJBQJANuAhAhsMAAoJ
ENDv2JyM/Rc/SxAAoNiZTWuCDqhshd4O5C0YzKkZdvIVAKDoliGHP3UaPPOumkh9
51V2n66yQg==
=/Mfp
-----END PGP PUBLIC KEY BLOCK-----

Re: need help

[Antony Stone]

On Friday 16 April 2004 7:28 pm, Matt Robineau wrote:

> I need help getting my rules working, I get an error: iptables: No
> chain/target/match by that name
>
> But it should work. I read how to do it in an online tutorial and it
> wont work for me, it keeps giving me this error.

It doesn't like one of the words you typed in the command you entered.

Since you didn't tell us what the command was, I can't tell you which word it 
was, but hopefully this is enough of a clue for you to work out the problem.

Regards,

Antony.

-- 
People who use Microsoft software should be certified.

                                                     Please reply to the list;
                                                           please don't CC me.

need help

[Karthik RC]

Hello ,
   can we do IP/MAC filering through iptables..
regards
from karthik

Re: need help

[hare ram]

Hi

Yes you can do MAC address based Filter using Iptables

hare
----- Original Message ----- 
From: "Karthik RC" <karthikeyan-rc@naturesoft.net>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, April 29, 2003 3:51 PM
Subject: need help


> Hello ,
>    can we do IP/MAC filering through iptables..
> regards
> from karthik
> 
> 
> 

Re: need help

[Julius Wijaya]

You can use MAC match option

example:

IPTABLES -A INPUT -m mac --mac-source 00:00:00:00:01:11

regards.
JW

*********** REPLY SEPARATOR  ***********

On 29/04/2003 at 10:21 AM Karthik RC wrote:

>Hello ,
>   can we do IP/MAC filering through iptables..
>regards
>from karthik

Re: need help

[Maciej Soltysiak]

> Hello ,
>    can we do IP/MAC filering through iptables..
Yes, you can match the source/destination IP address and/or source MAC
address.

Examples:
# iptables -A FORWARD -s 10.20.30.40 -j REJECT
# iptables -A OUTPUT -d 10.12.13.14 -j LOG

# iptables -A FORWARD -m mac --mac-source 00:01:23:45:67:89 -j ACCEPT
# iptables -A FORWARD -m mac --mac-source ! 00:01:23:45:67:89 -j REJECT

Please read
# iptables -m mac --help
# iptables --help
And whatever comes to your mind, the modules have their own help messages.
# iptables -p tcp --help
# iptables -m state --help
etc...

Regards,
Maciej

Need Help

[Mohammad Shakir]

[-- Attachment #1: Type: text/html, Size: 1368 bytes --]

Re: Need Help

[Davide]

[-- Attachment #1: Type: text/plain, Size: 1590 bytes --]

hello,
   this is the iptables version

/sbin/iptables -F 
/sbin/iptables -t nat -F 
 
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -P OUTPUT ACCEPT

echo "1" > /proc/sys/net/ipv4/ip_forward

# for trasparent proxy
/sbin/iptables -t nat -A PREROUTING -p tcp -s 0.0.0.0/0 --dport 80 -j REDIRECT --to-ports 8080
# for direct connection excluding HTTP
/sbin/iptables -A FORWARD -p tcp -s 0.0.0.0/0 --dport 80 -j DROP

 
Davide



  ----- Original Message ----- 
  From: Mohammad Shakir 
  To: netfilter@lists.samba.org 
  Sent: Friday, September 27, 2002 1:08 PM
  Subject: Need Help


  Dear Russell,

  I have this setup in ipchains and now I want to convert in iptables. plz help me. 

  /sbin/ipchains  -F forward   
  /sbin/ipchains  -F input     
  /sbin/ipchains  -F output    

  /sbin/ipchains  -P forward   ACCEPT
  /sbin/ipchains  -P input     ACCEPT
  /sbin/ipchains  -P output    ACCEPT

  echo "1" > /proc/sys/net/ipv4/ip_forward

  # for transparent proxy
  /sbin/ipchains -A input -j REDIRECT 8080 -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 80
  # for direct connection excluding HTTP
  /sbin/ipchains  -A forward -j -p all -s 0.0.0.0/0 -d 0.0.0.0/0

  It was my old setup in RedHat Linux 7.0Rel.

  Now I have installed new verions of RedHat Linux 7.2, with Kernel 2.4.7-10 and iptables version 1.2.3.


  thanks in advance 

  shakir 



------------------------------------------------------------------------------
  Join the world's largest e-mail service with MSN Hotmail. Click Here


[-- Attachment #2: Type: text/html, Size: 4200 bytes --]

Re: Need Help

[Antony Stone]

On Sunday 29 September 2002 11:26 pm, Davide wrote:

> hello,
>    this is the iptables version
>
> /sbin/iptables -F
> /sbin/iptables -t nat -F
>
> /sbin/iptables -P INPUT ACCEPT

Ugh.

> /sbin/iptables -P FORWARD ACCEPT

Ughhh !!!

> /sbin/iptables -P OUTPUT ACCEPT
>
> echo "1" > /proc/sys/net/ipv4/ip_forward

It's a good idea to put this *after* your rules, to avoid any period of time 
when the kernel's forwarding packets, but without a ruleset loaded...

> # for trasparent proxy
> /sbin/iptables -t nat -A PREROUTING -p tcp -s 0.0.0.0/0 --dport 80 -j
> REDIRECT --to-ports 8080

The -s 0.0.0.0/0 is redundant.

> # for direct connection excluding HTTP
> /sbin/iptables -A FORWARD -p tcp -s 0.0.0.0/0 --dport 80 -j DROP

Please do this as an explicit ACCEPT rule for *outbound* packets which do not 
match HTTP, and have a default DROP policy on the FORWARD chain (so you block 
anything trying to come in).

ie:
iptables -P FORWARD DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --dport ! 80 -o $extIF -j ACCEPT

Antony.

-- 

G- GIT/E d- s+:--(-) a+ C++++$ UL++++$ P+(---)>++ L+++(++++)$ !E W(-) N(-) o? 
w-- O !M V+++(--) !PS !PE Y+ PGP+> t- tv@ b+++ DI++ D--- e++>+++ h++ r@? 5? 
!X- !R K--?