0

i am running kerenl 3.14.18 and using iptables 1.4.21, built with these options --static-enable --disable-shared. when i run this command: /sbin/iptables -A PREROUTING -m -d 127.3.0.2/24 -j DNAT --to-destination 10.0.0.1 -p udp -dport 69 i get this error message: iptables v1.4.21: Couldn't load match `-d':No such file or directory

can any help explain what i am missing? thank you in advance.

  • 1
    Yes, that's a pretty obvious typo. Exactly what is this supposed to do? Where did you find this command? – Michael Hampton Feb 22 '15 at 23:42
  • 2
    -m needs something to match (one of what is listed by cat /proc/net/ip_tables_matches). – Brian Feb 23 '15 at 0:16
  • hi, i have a host system with 2 interfaces, eth0 and eth1. eth0 will receive packets with ip of 127.3.x.x. i want to forward these packets to go out of eth1 to a server (10.0.1). eth1 has ip of 192.168.0.100. the server needs to see the packets as if they are coming from the host (192.168.0.100). i think i can remove -m flag, but when i do, i am getting this error: iptables v1.4.21: multiple -d flags not allowed – mark Feb 23 '15 at 0:39
  • 1
    --dport, not -dport – larsks Feb 23 '15 at 2:41
1

hi, i have a host system with 2 interfaces, eth0 and eth1. eth0 will receive packets with ip of 127.3.x.x. i want to forward these packets to go out of eth1 to a server (10.0.1). eth1 has ip of 192.168.0.100. the server needs to see the packets as if they are coming from the host (192.168.0.100). i think i can remove -m flag, but when i do, i am getting this error: iptables v1.4.21: multiple -d flags not allowed

In order to accomplish this, you would use the followng iptables rules:

iptables -t nat -A PREROUTING -d 127.3.0.2/24 -p udp --dport 69 -j DNAT --to-destination 10.0.0.1 iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 192.168.0.100

But you should replace 127.3.0.2/24 with either a single IP (i.e. 127.3.0.2) or a valid CIDR range (e.g. 127.3.0.0/24). 127.3.0.2/24 is not a valid CIDR range as a /24 would cover 127.3.0.0-127.3.0.254. This would also redirect any traffic to any IP in that range to port 69 on 10.0.0.1.

Also, since port 69 is TFTP, I feel obliged to mention--if you are trying to use this for a PXE booting or other DHCP-based solution there is a strong likelihood it will not work as most vendors have trouble traversing subnets using PXE.

| improve this answer | |
  • hi wolfico. thank you! that's a great help. do you know if i need the rule for reverse direction as well, or does kernel keep track of the packets and will nat the return traffic automatically. also, since i am interested in directing only tftp traffic, will ping still works, or should i remove -dport 69 option? thanks again! – mark Feb 23 '15 at 19:28
  • @mark I have just revised my answer (there was a typo) – wolfico Feb 26 '15 at 0:11
  • The kernel will be able to route it in both directions automatically using the state table but you still need rules in both directions (see above) to handle addressing, otherwise packets in one direction will not have the correct source/destination address. – wolfico Feb 26 '15 at 0:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.