iptables v1.4.14: unknown option "--to-destination"

hack3rcon · 12-13-2015, 03:16 AM

Hello.
I use below iptables command on Debian but got an error :

$ sudo iptables -A INPUT -p tcp -j FORWARD --to-destination 172.30.10.11
iptables v1.4.14: unknown option "--to-destination"
Try `iptables -h' or 'iptables --help' for more information.

Any idea?

unSpawn · 12-13-2015, 05:25 AM

Wrong jump type (forward vs redirect) and probably wrong table too.

berndbausch · 12-13-2015, 06:27 AM

Quote:

Originally Posted by hack3rcon

Hello.
I use below iptables command on Debian but got an error :

$ sudo iptables -A INPUT -p tcp -j FORWARD --to-destination 172.30.10.11
iptables v1.4.14: unknown option "--to-destination"
Try `iptables -h' or 'iptables --help' for more information.

May I suggest the man page?
There is no target named FORWARD. There is however a FORWARD chain.
--to-destination is a parameter for the BALANCE and DNAT targets.

The suggested REDIRECT wouldn't work I guess. This is what the man page says:

Quote:

REDIRECT

This target is only valid in the nat table, in the PREROUTING and OUTPUT chains, and user-defined chains which are only called from those chains. It redirects the packet to the machine itself by changing the destination IP to the primary address of the incoming interface (locally-generated packets are mapped to the 127.0.0.1 address). It takes one option:

--to-ports port[-port]
This specifies a destination port or range of ports to use: without this, the destination port is never altered. This is only valid if the rule also specifies -p tcp or -p udp.

hack3rcon · 12-13-2015, 08:59 AM

What is your idea to solve it?

Ser Olmy · 12-13-2015, 09:57 AM

Quote:

Originally Posted by hack3rcon

What is your idea to solve it?

Well, what exactly is it that you want to accomplish?

The INPUT chain in the filter table is for filtering incoming traffic only. If you wish to redirect incoming traffic to another host, that's called "network address translation" ("destination NAT" to be precise), so you'll need to use the PREROUTING chain in the nat table:

Code:

iptables -t nat -A PREROUTING -p tcp --dport <some_port_number> -j DNAT --to-destination 172.30.10.11:<a_port_number>

Note that you'll also need a firewall rule in the FORWARD chain to allow the packets you just NATed.

hack3rcon · 12-15-2015, 06:19 AM

Thank you.
For example, I want when someone Remote Desktop to me then they request forward to 172.30.10.11 that is a Windows machine. I guess remote desktop port is 3389 on Windows but how about "--dport" ?

Ser Olmy · 12-15-2015, 02:36 PM

Quote:

Originally Posted by hack3rcon

TI guess remote desktop port is 3389 on Windows but how about "--dport" ?

The --dport parameter is used to specify the destination port number of the original, un-NATed packet. You can use the same port number as the service you're redirecting the packet to, but it is also possible to use a different port.

This should do the trick:

Code:

iptables -t nat -A PREROUTING -p tcp --dport 3389 -j DNAT --to-destination 172.30.10.11:3389
iptables -t filter -A FORWARD -d 172.30.10.11/32 -p tcp --dport 3389 -j ACCEPT

You may want to add an input interface match (-i <interface>) to the PREROUTING rule and perhaps both an input and an output interface match (-i <interface> -o <interface>) to the FORWARD rule.

hack3rcon · 12-16-2015, 05:00 AM

I did :

$ sudo iptables -t filter -A FORWARD -d 172.30.10.11/32 -p tcp --dport 3389 -j ACCEPT -i eth1 -o eth1

and my iptables rules are :

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere 172.30.10.11 tcp dpt:3389

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

but not worked

Ser Olmy · 12-16-2015, 08:45 AM

How can the input and output interfaces be the same (eth1)?