[SOLVED] Cannot redirect port number

factor3 · 03-07-2014, 09:15 AM

Greetings:

I am attempting to set up a port redirect using iptables. After looking at various instructions, posts, and blogs, I have determined that the following command line entry should work:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

It does not appear to, though. When I enter this line I get the following error message:

iptables: No chain/target/match by that name.

Can someone tell me what exactly does that mean and how I can get this redirect to work? Thank you...

Ser Olmy · 03-08-2014, 04:08 AM

The syntax is correct if what you want to do is redirect HTTP traffic passing through a Linux system acting as a router to a local proxy service running on port 8080.

The error message means you're running a Linux kernel that lacks support for either the PREROUTING chain, the REDIRECT target or the "-p tcp --dport" match. The most likely culprit is the REDIRECT match, and the output from the following command should be enough to confirm or disprove that:

Code:

zcat /proc/config.gz | grep TARGET_REDIRECT

Which distribution and kernel version (uname -rm) are you running?

factor3 · 03-08-2014, 12:37 PM

Greetings:

Apparently, there is no config.gz on my system. I got "no such file or directory"errors when I attempted the zcat, and when I did a find (different distributions may put it in different places) it appears that the file is nowhere on my system.

The distribution is Fedora. The kernel version is:

2.6.18-194.17.1.el5.028stab070.7 i686

The fact that the config.gz isn't there makes me nervous. Is this a configuration problem? Is there something missing from my system? Is there something I need to add or update?

Ser Olmy · 03-08-2014, 02:47 PM

The /proc directory contains a virtual file system, and all files within it are generated by the kernel. They can't be anywhere else. The lack of a /proc/config.gz file just means that the Fedora developers (for some unknown reason) decided to turn off that feature. You may be able to locate a copy of the .config file in the /boot directory, though.

2.6.18 is positively ancient (released in December 2003), but is certainly supports the REDIRECT target, unless support was explicitly disabled at compile time. You could be missing a kernel module (xt_REDIRECT.ko in this case). This is more of a Fedora issue than a netfilter/iptables problem.

whizje · 03-08-2014, 03:00 PM

Probably you just need to load the extra iptables modules search for load iptables modules Fedora.

factor3 · 03-08-2014, 08:04 PM

Thanks, Ser Olmy and Whizje, for your help so far.

I am a real beginner when it comes to matters of these internals. I think I will need a little more info...

How exactly do I search for the modules mentioned? Exactly what modules am I searching for? More importantly, how can I acquire them for my system if (as I suspect) they are not there?

I would also like to upgrade my kernel. The system my distribution is running on is a VM provided by an ISP -- but it is *my* VM and I should be able to update it. Is there a safe way to provide a more up- to- date kernel on it?

Ser Olmy · 03-09-2014, 05:01 AM

Modules reside in the /lib/modules/<kernel_version> directory, where <kernel_version> is the version as reported by uname -r. The netfilter modules are in the kernel/net/netfilter subdirectory. In other words, you should look for /lib/modules/2.6.18-194.17.1.el5.028stab070.7/kernel/net/netfilter/xt_REDIRECT.ko.

You could also try modprobe:

Code:

modprobe xt_REDIRECT

It should locate and load the module (and any dependencies) automatically. If it fails, the necessary netfilter modules aren't installed. In that case, you may need to install some .rpm package; I don't know how Fedora handles the distribution of kernel modules.

It seems the recommended method for upgrading a Fedora system is to boot from the installation DVD/ISO and let the installer handle the upgrade process.

factor3 · 03-11-2014, 10:20 PM

My problem is, as it turns out, that the ISP I was paying for my VM gave me Fedora 13(!), and an incomplete version at that.

Several modules were missing from it, including the redirect module. I filed several trouble tickets on the problems, and not hearing back from anyone after several days I dumped them for another ISP.

I have other problems now, but they aren't relevant to this one so I am marking this as answered.

Again: thanks all. Without your answers I would not have realized I needed to dump this ISP with their old version of Linux...