# iptables NAT (solved)

## anatolie

i try'd all sugestion from this subforum

 *Quote:*   

> 
> 
> #iptables -t nat -F
> 
> FATAL: Module ip_tables not found.
> ...

 

what's wrong?Last edited by anatolie on Wed Nov 07, 2007 4:41 pm; edited 1 time in total

----------

## elestedt

Have you looked at http://www.gentoo.org/doc/en/home-router-howto.xml?

----------

## Sleipnir

Make sure that NAT is compiled as a module.

```

CONFIG_IP_NF_NAT=m

```

Maybe also the Gentoo-HowTo helps...

----------

## anatolie

ok kernel works

but....

using:http://www.gentoo.org/doc/en/home-router-howto.xml

i have been created rules

but i have no inet access from client

my client on win vista show me beauty icon of network connection with internet

but ping(www, chats nothing) does not work

 *Quote:*   

> #iptable -L
> 
> Chain INPUT (policy ACCEPT)
> 
> target     prot opt source               destination         
> ...

 

tcpdump output on gateway

 *Quote:*   

> 17:19:39.663084 IP host-86-106-240-76.moldtelecom.md.15961 > 192.168.0.100.61363: . ack 3494827815 win 64240
> 
> 17:19:39.663765 IP 192.168.0.100.61363 > host-86-106-240-76.moldtelecom.md.15961: . 1:1461(1460) ack 0 win 256
> 
> 17:19:39.663889 IP 192.168.0.100.61363 > host-86-106-240-76.moldtelecom.md.15961: . 1461:2921(1460) ack 0 win 256
> ...

 

192.168.0.1 gw

192.168.0.100 client

host-86-106-240-76.moldtelecom.md my ISP

static.195.22.243.10.mdl.net other ISP company

whats wrong?

----------

## elestedt

A wild quess says that somethings wrong with your DNS lookup.

Try to, from your client, ping one of the IP addresses for www.google.com.

Find it by pinging www.google.com on your gateway...

If that works I would recommend checking /etc/resolv.conf on your client.

If your nameserver is your gateway, you need to add a DNS proxy/cache to your gateway. Have a look a dnsmasq

----------

## anatolie

i cheked up access website by ip

it does not work

any other ideas?

----------

## Hu

Post the output of iptables-save -c, which is more complete than iptables -L.  Is the tcpdump output from your internal (LAN) interface or your external (WAN) interface?  Traffic sent to your ISP should not have a 192.168.x.x address.  If it does, the request will not work.

As a blind shot before seeing your rules, add a masquerade rule: iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -j MASQUERADE.

----------

## anatolie

solved

thx --world

 :Smile: 

----------

## Zucca

 *Sleipnir wrote:*   

> Make sure that NAT is compiled as a module.
> 
> ```
> 
> CONFIG_IP_NF_NAT=m
> ...

 

```
zgrep -i "ip_nf" /proc/config.gz

# CONFIG_IP_NF_QUEUE is not set

CONFIG_IP_NF_IPTABLES=m

CONFIG_IP_NF_MATCH_IPRANGE=m

CONFIG_IP_NF_MATCH_TOS=m

CONFIG_IP_NF_MATCH_RECENT=m

CONFIG_IP_NF_MATCH_ECN=m

CONFIG_IP_NF_MATCH_AH=m

CONFIG_IP_NF_MATCH_TTL=m

CONFIG_IP_NF_MATCH_OWNER=m

CONFIG_IP_NF_MATCH_ADDRTYPE=m

CONFIG_IP_NF_FILTER=m

CONFIG_IP_NF_TARGET_REJECT=m

CONFIG_IP_NF_TARGET_LOG=m

# CONFIG_IP_NF_TARGET_ULOG is not set

CONFIG_IP_NF_MANGLE=m

CONFIG_IP_NF_TARGET_TOS=m

CONFIG_IP_NF_TARGET_ECN=m

CONFIG_IP_NF_TARGET_TTL=m

CONFIG_IP_NF_RAW=m

# CONFIG_IP_NF_ARPTABLES is not set
```

As you can see. No such option.

```
uname -a

Linux zelan 2.6.22-gentoo-r8 #5 Wed Nov 7 18:54:02 EET 2007 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
```

iptables fails as I try following commands:

```
iptables -P FORWARD ACCEPT && iptables -A OUTPUT -o eth0 -j ACCEPT && iptables -A INPUT -i eth0 -j ACCEPT && iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

iptables v1.3.8: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.
```

I've compiled kernel, modules and iptables many times (I've also googled;) ). 

Any help?

     - Zucca

----------

## elestedt

 *Zucca wrote:*   

>  *Sleipnir wrote:*   Make sure that NAT is compiled as a module.
> 
> ```
> 
> CONFIG_IP_NF_NAT=m
> ...

 

You need the the following:

```
 Symbol: NF_NAT [=n]                                                        │  

  │ Prompt: Full NAT                                                           │  

  │   Defined at net/ipv4/netfilter/Kconfig:183                                │  

  │   Depends on: NET && INET && NETFILTER && IP_NF_IPTABLES && NF_CONNTRACK_I │  

  │   Location:                                                                │  

  │     -> Networking                                                          │  

  │       -> Networking support (NET [=y])                                     │  

  │         -> Networking options                                              │  

  │           -> Network packet filtering framework (Netfilter) (NETFILTER [=n │  

  │             -> IP: Netfilter Configuration                                 │  

  │               -> IP tables support (required for filtering/masq/NAT) (IP_N │  

```

Did you look at the guide I posted further up?

----------

## Zucca

Yes.

I have enabled support for all but ULOG.

I just need to get past this error:

```
iptables v1.3.8: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.
```

----------

## elestedt

 *Zucca wrote:*   

> Yes.
> 
> I have enabled support for all but ULOG.
> 
> I just need to get past this error:
> ...

 

Have you enabled IP_NF_TARGET_MASQUERADE?

----------

## Zucca

There's no such option:

```
zgrep -i IP_NF /proc/config.gz

# CONFIG_IP_NF_QUEUE is not set

CONFIG_IP_NF_IPTABLES=m

CONFIG_IP_NF_MATCH_IPRANGE=m

CONFIG_IP_NF_MATCH_TOS=m

CONFIG_IP_NF_MATCH_RECENT=m

CONFIG_IP_NF_MATCH_ECN=m

CONFIG_IP_NF_MATCH_AH=m

CONFIG_IP_NF_MATCH_TTL=m

CONFIG_IP_NF_MATCH_OWNER=m

CONFIG_IP_NF_MATCH_ADDRTYPE=m

CONFIG_IP_NF_FILTER=m

CONFIG_IP_NF_TARGET_REJECT=m

CONFIG_IP_NF_TARGET_LOG=m

# CONFIG_IP_NF_TARGET_ULOG is not set

CONFIG_IP_NF_MANGLE=m

CONFIG_IP_NF_TARGET_TOS=m

CONFIG_IP_NF_TARGET_ECN=m

CONFIG_IP_NF_TARGET_TTL=m

CONFIG_IP_NF_RAW=m

# CONFIG_IP_NF_ARPTABLES is not set
```

I wonder what that IP_NF_QUEUE is... I have enabled all using menuconfig...

----------

## elestedt

 *Zucca wrote:*   

> There's no such option:
> 
> ```
> zgrep -i IP_NF /proc/config.gz
> 
> ...

 

If you have enabled all in menuconfig then it should exist. In menuconfig it is located here:

```
  │ Symbol: IP_NF_TARGET_MASQUERADE [=n]                                                                   │

  │ Prompt: MASQUERADE target support                                                                      │

  │   Defined at net/ipv4/netfilter/Kconfig:198                                                            │

  │   Depends on: NET && INET && NETFILTER && NF_NAT                                                       │

  │   Location:                                                                                           

  │     -> Networking                                                                                     

  │       -> Networking support (NET [=y])                                                                 │

  │         -> Networking options                                                                          │

  │           -> Network packet filtering framework (Netfilter) (NETFILTER [=y])                           │

  │             -> IP: Netfilter Configuration                                                             │

  │               -> IP tables support (required for filtering/masq/NAT) (IP_NF_IPTABLES [=y])             │

  │                 -> Full NAT (NF_NAT [=y])                                                              │
```

In short, you have to enable all that 'Depends on' indicates, and all they depend on; then it should be visible ans selectable (it is here and I'm running the same kernel).

----------

## Zucca

All the depencies met the criteria:

```
zegrep "CONFIG_NET(=| )|CONFIG_INET(=| )|CONFIG_NETFILTER(=| )|CONFIG_IP_NF_IPTABLES(=| )|CONFIG_NF_CONNTRACK_IPV4(=| )" /proc/config.gz

CONFIG_NET=y

CONFIG_INET=y

CONFIG_NETFILTER=y

CONFIG_IP_NF_IPTABLES=m
```

And one didn't found at all..? (CONFIG_NF_CONNTRACK_IPV4)

Menuconfig says that it needs CONFIG_NF_CONNTRACK_IPV4, but it cannot be found. O.o I tried also with menuconfig's search.

----------

## elestedt

 *Zucca wrote:*   

> All the depencies met the criteria:
> 
> ```
> zegrep "CONFIG_NET(=| )|CONFIG_INET(=| )|CONFIG_NETFILTER(=| )|CONFIG_IP_NF_IPTABLES(=| )|CONFIG_NF_CONNTRACK_IPV4(=| )" /proc/config.gz
> 
> ...

 

I have that one here:

```
  │ Symbol: NF_CONNTRACK_IPV4 [=y]                                                                                                                                                                                                                                                                                       

  │ Prompt: IPv4 connection tracking support (required for NAT)                                                                                                                                                                                                                                        

  │   Defined at net/ipv4/netfilter/Kconfig:8                                                                                                                                                                                                                                                                            

  │   Depends on: NET && INET && NETFILTER && NF_CONNTRACK                                                                                                                                                                                                                                                               

  │   Location:                                                                                                                                                                                                                                                                                                          

  │     -> Networking                                                                                                                                                                                                                                                                                                    

  │       -> Networking support (NET [=y])                                                                                                                                                                                                                                                                               

  │         -> Networking options                                                                                                                                                                                                                                                                                        

  │           -> Network packet filtering framework (Netfilter) (NETFILTER [=y])                                                                                                                                                                                                                                         

  │             -> IP: Netfilter Configuration                                                                                                                                                                                                                                                                           

```

----------

## Zucca

I don't get this.

I have enabled every option that is needed.

Here's how it shows up in my menuconfig

----------

## elestedt

 *Zucca wrote:*   

> I don't get this.
> 
> I have enabled every option that is needed.
> 
> Here's how it shows up in my menuconfig

 

Right above 'IP tables support' you should have 'IPv4 connection tracking support (required for NAT)' what does that say?

If you don't have that, then there's some config options missing elsewhere.

Sorry for the long response time

----------

