3

Should be simple using iptables, as for example described in this post by Richard Fergie, but my device, a Synology DS115j (Running DSM 5.0) is not able to do so apparently:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

returns

iptables v1.4.21: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

Do I need to use the nat table at all for port forwarding? This is no gateway and do not want to forward to another device, only to another local port.

Context:

  • My goal is to run a server on a non-privileged port to avoid having to run it as root.
  • I know about setcap and authbind but these are not available on a Synology NAS (DSM5).
  • Synology DS115j also does not support Docker.
2

If the synology firewall does not already use nat then the necessary kernel modules will probably not be enabled, so -t nat will not find the table. You need to, as root:

cd /lib/modules
insmod nf_nat.ko 
insmod iptable_nat.ko
insmod ipt_REDIRECT.ko

Then iptables -L -t nat should list the empty chains, lsmod|grep nat should show the modules, and you can add your rule.

1
  • This worked excellent on my Synology DS115j NAS.
    – Marcel
    Jan 8 '17 at 21:32
1

The Synology Os (DSM) uses a closed source binary called firewalltool to rebuild the iptables dump. You could invest time to understand how it works internally by looking at /usr/syno/etc/rc.d/S01iptables.sh and /etc/firewall, but keep in mind that any DSM update may overwrite manual changes you made.

3
  • I looked into the .sh script a bit and I am terrified to mingle with that. Also, besides getting overwritten at update, it breaks the Admin GUI firewall feature, AFAIK.
    – Marcel
    Jan 6 '17 at 13:58
  • 1
    In any case, when I try this kind of things I normally do it via containers, which keep everything "contained", without populating the DSM. Check if your model supports virtualization (docker) synology.com/en-us/dsm/app_packages/Docker
    – marc
    Jan 6 '17 at 14:17
  • Good Idea. Unfortunately, it also does not support Docker. I looked it up, and updated the question.
    – Marcel
    Jan 6 '17 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.