Bekijk de volledige versie : Iptables
Hi, doesnt REDIRECT work? Why? Is there anything I can do? Trying to forward all 80 request to junkbuster..
[admin@myrouter root]$ iptables -t INPUT -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
iptables v1.2.7a: Unknown arg `--to-ports'
Try `iptables -h' or 'iptables --help' for more information.
Sjur
--to-port, not --to-ports.
Well my iptables tutorial actually says --to-ports.. Serveral times.. Well anyway:
[admin@myrouter root]$ iptables -t INPUT -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables v1.2.7a: Unknown arg `--to-port'
Try `iptables -h' or 'iptables --help' for more information.
So I guess that don't work either.. But thanx for the reply anyway! :)
Sjur
iptables -t INPUT -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables v1.2.7a: Unknown arg `--to-port'
Try `iptables -h' or 'iptables --help' for more information.
Sjur
Both --to-port and --to-ports are working on my 1.2.11 iptables system but you have a problem here, it's -t nat, not -t INPUT !!!
But still, I tried the correct command on my wl500gx, that also does not work. I believe it's a bug.
Cheers
Has anyone else got this working or is it a bug? Or a is it only available in newer versions of iptables? I really don't think so as the version in the latest fimware is v1.2.7a and the tutorial i got the example from is written for 1.1.19, but maybe I got it wrong...
If it's not possible, is there another way to forward all http traffic to the http proxy transparently?
Sjur
Has anyone else got this working or is it a bug? Or a is it only available in newer versions of iptables? I really don't think so as the version in the latest fimware is v1.2.7a and the tutorial i got the example from is written for 1.1.19, but maybe I got it wrong...
It's not a question of newer versions. 'iptables' has various patches, and each has various interactions within itself and also with the kernel. If you are willing to wait a little, I will try to give it a shot to compile something to check. Probably this weekend. In the meantime you might want to check different firmware version to see if the same problem exist.
Cheers
Sweet. I'm in no hurry.. I'll see if I can get around to trying out the other firmwares. Sadly I'm sharing my connection with some neighbours so I can only work on this stuff when no one else is on. Bad for troubleshooting, good for wallet.
But if anyone else has a minute to try running this line on their router and post the results and firmware number here, that would be sweet:
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
Sjur
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
I actually found the fix. If you go to /usr/lib/iptables or something ( I don't have the machine in front of me ), you should find all the iptables extension share libraries. But REDIRECT is missing.
Now the question is how do you want to receive the fix. If you are using a USB firmware file system, you only need to add one file into the directory. If you are using onboard firmware, you will have to flash a new firmware.
Cheers
Great! But where can I get this file? Perhaps you can post it here? Or provide a link?
SJur
Great! But where can I get this file? Perhaps you can post it here? Or provide a link?
SJur
OK gzipped and attached.
Cheers
Great, thx. Ok so I have an USB, but I still boot from, and run the filesystem in RAM. So the /usr/lib/ dir is read-only.. How can I add the file there? nvram? Don't know how that stuff works... Or can I copy the file somewhere else and add it to the .files-file?
Thax alot for your help and patience!
And if Oleg or any other adm read this? Why is this extension missing? Will you include it in the next fw release?
Sjur
Great, thx. Ok so I have an USB, but I still boot from, and run the filesystem in RAM. So the /usr/lib/ dir is read-only.. How can I add the file there? nvram? Don't know how that stuff works... Or can I copy the file somewhere else and add it to the .files-file?
Hmmm that's why I was asking you if you want a trx or a file. Maybe you go and read oleg's custom firmware pages. It explains how you make your USB filesystem. But it means you have to stick in the USB there all the time.
If that's not ok, you have to get a TRX firmware. But there is no guarantee that your router is still bootable after the firmware upgrade !!! :p
And if Oleg or any other adm read this? Why is this extension missing? Will you include it in the next fw release?
I think they view this is something not previously supported. So the issue of why it is missing does not arise.
Cheers
Ahh.. So you have a trx that is olegs fw + this one file..? If so you don't really think my router will be unbootable? And if it gets unbootable there is still a way to get it up and running again?
Or should i ask oleg kindly to include the file in the next fw?
Sjur
PS: I have looked into the whole booting from usb, but I'm having a hard time partitioning the usb stick. I have tried partition magic, but it doesn't show up anywhere there..
I've included REDIRECT target to the firmware build, so just wait. Let me know if you need other targets as well.
Great, Oleg! For me REDIRECT would do the trick, but I don't really know if there are any other targets that are missing? If there are they should probably be added to have full options with your iptables, no? Unless there is a memory issue of course...
BTW, do you have an ETA of next release? I have seen there some betas around, but I think I'll wait for the next release.. No rush.. :)
S
tomilius
01-03-2005, 01:36
REJECT is missing, I believe. It'd be nice for that to be thrown in as well. It's all quite small in size.