Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to redirect the traffic in my lan network through squid proxy but I am having some problems with iptables rules.

When I use the following rule:

# iptables -I FORWARD -s 192.168.1.0/255.255.255.0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.196:3128

I get the following error:

x_tables: ip_tables: DNAT target: only valid in nat table, not filter

I have tried using PREROUTING chain but there is nothing like this in my iptables:

# iptables -I PREROUTING -s 192.168.1.0/255.255.255.0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.196:3128
iptables: No chain/target/match by that name.

I am using iptables version v.1.4.10

# iptables -t nat -L PREROUTING
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
prerouting_rule  all  --  anywhere             anywhere            
zone_lan_prerouting  all  --  anywhere             anywhere            
zone_wan_prerouting  all  --  anywhere             anywhere

my whole iptables -nLv

root@OpenWrt:~# iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  776 93902 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           ctstate RELATED,ESTABLISHED 
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
 3231  164K syn_flood  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x02 
 7098  429K input_rule  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 7096  429K input      all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           MAC XX:XX:XX:XX:XX:XX udp spt:22509  
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           MAC XX:XX:XX:XX:XX:XX tcp spts:59000:65399 
    0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           MAC XX:XX:XX:XX:XX:XX udp spts:49950:65399 
 8271 3071K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           ctstate RELATED,ESTABLISHED 
  451 44484 forwarding_rule  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  451 44484 forward    all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    5   276 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 7408  581K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           ctstate RELATED,ESTABLISHED 
    0     0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
  206 13814 output_rule  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  206 13814 output     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  446 44208 zone_lan_forward  all  --  br-lan *       0.0.0.0/0            0.0.0.0/0           
    0     0 zone_wan_forward  all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           

Chain forwarding_lan (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain forwarding_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain forwarding_wan (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  515 43070 zone_lan   all  --  br-lan *       0.0.0.0/0            0.0.0.0/0           
 6560  385K zone_wan   all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           

Chain input_lan (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain input_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain input_wan (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain output (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  206 13814 zone_lan_ACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  203 13301 zone_wan_ACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain output_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain reject (5 references)
 pkts bytes target     prot opt in     out     source               destination         
 3249  166K REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with tcp-reset 
 3257  198K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable 

Chain syn_flood (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 3231  164K RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x02 limit: avg 25/sec burst 50 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain zone_lan (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  515 43070 input_lan  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  515 43070 zone_lan_ACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain zone_lan_ACCEPT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    3   513 ACCEPT     all  --  *      br-lan  0.0.0.0/0            0.0.0.0/0           
  515 43070 ACCEPT     all  --  br-lan *       0.0.0.0/0            0.0.0.0/0           

Chain zone_lan_DROP (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      br-lan  0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  br-lan *       0.0.0.0/0            0.0.0.0/0           

Chain zone_lan_REJECT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 reject     all  --  *      br-lan  0.0.0.0/0            0.0.0.0/0           
    5   272 reject     all  --  br-lan *       0.0.0.0/0            0.0.0.0/0           

Chain zone_lan_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  446 44208 zone_wan_ACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    5   272 forwarding_lan  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    5   272 zone_lan_REJECT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain zone_wan (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   64 21010 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:68 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 8 
 6496  364K input_wan  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 6496  364K zone_wan_REJECT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain zone_wan_ACCEPT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
  644 57237 ACCEPT     all  --  *      eth1    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           

Chain zone_wan_DROP (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      eth1    0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           

Chain zone_wan_REJECT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 reject     all  --  *      eth1    0.0.0.0/0            0.0.0.0/0           
 6496  364K reject     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           

Chain zone_wan_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 forwarding_wan  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 zone_wan_REJECT  all  --  *      *       0.0.0.0/0            0.0.0.0/0 
share|improve this question
    
Could you provide the output of iptables -t nat -L PREROUTING? –  Dave Oct 16 '13 at 15:30
    
@Dave I have updated the answer –  Patryk Oct 16 '13 at 15:42

1 Answer 1

You need to specify that the rule should go into the nat table, additionally DNAT commands need to go the PREROUTING chain and you need to be careful that you do not generate a loop.

iptables -t nat -I PREROUTING -i br-lan -s ! 192.168.1.196  -p tcp --dport 80 -j DNAT --to-destination 192.168.1.196:3128

The default table is the filter table.

Do not forget, that you also need MASQUERADE/SNAT to rewrite the source address:

iptables -t nat -I POSTROUTING -p tcp --dport 80 -j MASQUERADE

This HOWTO provides more options and explanations.

share|improve this answer
    
I have just checked and I don't have FORWARD chain in nat table as shown here static.thegeekstuff.com/wp-content/uploads/2011/01/… –  Patryk Oct 17 '13 at 12:21
    
@Patryk Thanks for the comment, there was another problem which I fixed now. –  jofel Oct 17 '13 at 13:35
    
Thanks for help but this is still not working for me :/ –  Patryk Oct 17 '13 at 13:41
    
@Patryk: Are your sure, that the problem is not on the squid side? It needs special setting if it should work as a transparent proxy. –  jofel Oct 17 '13 at 16:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.