0

I have a system whose iptables configuration are

# iptables  -A FORWARD -m conntrack --ctstate SNAT,DNAT -j ACCEPT
iptables: No chain/target/match by that name.

sudo iptables -L -v
Password: 
Chain INPUT (policy ACCEPT 7833 packets, 816K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 2980 packets, 221K bytes)
 pkts bytes target     prot opt in     out     source               destination      

The linux version is 4.12.28 Here are my kernel modules loaded? I am unsure on what am I missing here

$ lsmod
Module                  Size  Used by
iptable_nat            16384  0
nf_conntrack_ipv4      16384  1
nf_defrag_ipv4         16384  1 nf_conntrack_ipv4
nf_nat_ipv4            16384  1 iptable_nat
ipt_MASQUERADE         16384  0
nf_nat_masquerade_ipv4    16384  1 ipt_MASQUERADE
nf_nat                 28672  2 nf_nat_masquerade_ipv4,nf_nat_ipv4
nf_conntrack          139264  5 nf_conntrack_ipv4,ipt_MASQUERADE,nf_nat_masquerade_ipv4,nf_nat_ipv4,nf_nat
iptable_filter         16384  0
ip_tables              20480  2 iptable_filter,iptable_nat
x_tables               24576  3 ip_tables,iptable_filter,ipt_MASQUERADE
fanctl                 45056  0
rtc                    16384  0
cardirq                20480  0

I see the SNAT, DNAT symbols in xt_nat but I don't see them in my module. My guess is that they are getting loaded indirectly. Please help.

  • Not sure why your rule doesn't work, but another (working) way to forward NATed packets is -m state --state ESTABLISHED,RELATED. And one way to debug the problem would be to directly alter iptables instead of rewriting the configuration file, and see if you get more meaningful error messages. – dirkt Aug 22 '19 at 8:00
  • # iptables -A FORWARD -m conntrack --ctstate SNAT,DNAT -j ACCEPT iptables: No chain/target/match by that name. – kurramkurram D Aug 22 '19 at 8:37
  • 1
    Check if filter module loaded by lsmod | grep iptable_filter – ibrahim Aug 22 '19 at 9:11
  • What does iptables -L -vn show? – wurtel Aug 22 '19 at 11:09
  • I have updated now. It shows nothing. – kurramkurram D Aug 23 '19 at 0:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.