I'm attempting to redirect port 80 to 8080 for my MITM ssl strip attack on kali linux rasberry pi, I'm getting the error: unknown option "--dport" when trying to run the command:

iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j REDIRECT --to-port 8080

Has anyone else encountered this? or have any idea how I can solve this? I've been scouring the internet for days and can't find anything.

  • Someone actually told me the solution. Kali and debian buster use nftables. I needed to switch back to the nftables legacy version and it worked.
    – MichaelPV
    Oct 26, 2019 at 17:56

4 Answers 4


I had the same problem, I discovered that Kali uses nftables so whtat I did was to use the iptables-legacy mode that nftables provide. So the command would be:

iptables-legacy -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j REDIRECT --to-port 8080

Try adding -m tcp in between -p tcp and --dport 80.


Kali (and debian buster) actually use nftables - you're going to want to follow https://wiki.debian.org/nftables to switch back to the legacy version that most websites tell you to use. It's fine if the arptables and ebtables say they don't exist. nftables is the new way of doing things, if people would ever move to it.


iptables-legacy is not doing the trick anymore on Debian 11.

Adding -m tcp in between -p tcp and --dport 80 solved this for me as suggested in the answer from Joseph. It uses iptables-extensions to add the --dport parameter for tcp and other protocols, see here

On Debian 11 I had the issue that iptables wasn't able to load any extensions claiming:

iptables v1.8.7 (legacy): Couldn't load match 'tcp':No such file or directory

I was able to solve this by explicitly add /lib/x86_64-linux-gnu/xtables to /etc/ld.so.conf.d/x86_64-linux-gnu.conf and rebooting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.