# iptables and nat to a different machine

## 102039

Hi,

I am trying to setup a port forwarding from one alias IP on one machine to another alias IP on a different machine:

```
iptables -t nat -A POSTROUTING -p tcp -d <source IP> --dport <port> -j SNAT –-to-destination <target IP>
```

However it always fails with:

```
Bad argument `–-to-destination'
```

What I also tried:

- Using --to instead of --to-destination, same result as above, just with "--to" as a bad argument.

- Replaced SNAT with DNAT.

- Append the target port to the <target IP> with :<port>

Maybe I am using an old-style-method not working in newer kernels/iptables versions, however instructions like that are posted all over the web.

Any idea?

----------

## Hu

According to man iptables-extensions, SNAT uses --to-source, not --to-destination.

----------

## dE_logics

You should use DNAT jump. I think.

----------

## 102039

Hi,

thanks for your anwers, however I already tried -j DNAT (see above), didn't work either.

----------

## truc

you have to use DNAT here, to --to-destination, and since you're changing destination, this rule has to be in PREROUTING

----------

## 102039

Hi,

same result with

```
iptables -t nat -A PREROUTING -p tcp -d <source IP> --dport <port> -j DNAT –-to-destination <target IP>
```

----------

## truc

then, check you kernel conf I think

----------

## 102039

Any idea what to look for exactly? Cause I think I've got all the options enabled:

```

#

# Networking options

#

CONFIG_PACKET=y

# CONFIG_PACKET_DIAG is not set

CONFIG_UNIX=y

# CONFIG_UNIX_DIAG is not set

# CONFIG_XFRM_USER is not set

# CONFIG_NET_KEY is not set

CONFIG_INET=y

# CONFIG_IP_MULTICAST is not set

CONFIG_IP_ADVANCED_ROUTER=y

# CONFIG_IP_FIB_TRIE_STATS is not set

CONFIG_IP_MULTIPLE_TABLES=y

# CONFIG_IP_ROUTE_MULTIPATH is not set

# CONFIG_IP_ROUTE_VERBOSE is not set

CONFIG_IP_PNP=y

CONFIG_IP_PNP_DHCP=y

# CONFIG_IP_PNP_BOOTP is not set

# CONFIG_IP_PNP_RARP is not set

# CONFIG_NET_IPIP is not set

# CONFIG_NET_IPGRE_DEMUX is not set

# CONFIG_ARPD is not set

# CONFIG_SYN_COOKIES is not set

# CONFIG_INET_AH is not set

# CONFIG_INET_ESP is not set

# CONFIG_INET_IPCOMP is not set

# CONFIG_INET_XFRM_TUNNEL is not set

# CONFIG_INET_XFRM_MODE_BEET is not set

CONFIG_INET_LRO=y

CONFIG_INET_DIAG=y

CONFIG_INET_TCP_DIAG=y

CONFIG_INET_UDP_DIAG=y

# CONFIG_TCP_CONG_ADVANCED is not set

CONFIG_TCP_CONG_CUBIC=y

CONFIG_DEFAULT_TCP_CONG="cubic"

# CONFIG_TCP_MD5SIG is not set

# CONFIG_IPV6 is not set

# CONFIG_NETLABEL is not set

# CONFIG_NETWORK_SECMARK is not set

# CONFIG_NETWORK_PHY_TIMESTAMPING is not set

CONFIG_NETFILTER=y

# CONFIG_NETFILTER_DEBUG is not set

CONFIG_NETFILTER_ADVANCED=y

#

# Core Netfilter Configuration

#

CONFIG_NETFILTER_NETLINK=y

# CONFIG_NETFILTER_NETLINK_ACCT is not set

# CONFIG_NETFILTER_NETLINK_QUEUE is not set

CONFIG_NETFILTER_NETLINK_LOG=y

CONFIG_NF_CONNTRACK=y

CONFIG_NF_CONNTRACK_MARK=y

CONFIG_NF_CONNTRACK_PROCFS=y

# CONFIG_NF_CONNTRACK_EVENTS is not set

# CONFIG_NF_CONNTRACK_TIMEOUT is not set

# CONFIG_NF_CONNTRACK_TIMESTAMP is not set

# CONFIG_NF_CT_PROTO_DCCP is not set

# CONFIG_NF_CT_PROTO_SCTP is not set

# CONFIG_NF_CT_PROTO_UDPLITE is not set

# CONFIG_NF_CONNTRACK_AMANDA is not set

# CONFIG_NF_CONNTRACK_FTP is not set

# CONFIG_NF_CONNTRACK_H323 is not set

# CONFIG_NF_CONNTRACK_IRC is not set

# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set

# CONFIG_NF_CONNTRACK_SNMP is not set

# CONFIG_NF_CONNTRACK_PPTP is not set

# CONFIG_NF_CONNTRACK_SANE is not set

# CONFIG_NF_CONNTRACK_SIP is not set

# CONFIG_NF_CONNTRACK_TFTP is not set

# CONFIG_NF_CT_NETLINK is not set

# CONFIG_NF_CT_NETLINK_TIMEOUT is not set

CONFIG_NF_NAT=y

CONFIG_NF_NAT_NEEDED=y

# CONFIG_NF_NAT_AMANDA is not set

# CONFIG_NF_CONNTRACK_FTP is not set

# CONFIG_NF_CONNTRACK_H323 is not set

# CONFIG_NF_CONNTRACK_IRC is not set

# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set

# CONFIG_NF_CONNTRACK_SNMP is not set

# CONFIG_NF_CONNTRACK_PPTP is not set

# CONFIG_NF_CONNTRACK_SANE is not set

# CONFIG_NF_CONNTRACK_SIP is not set

# CONFIG_NF_CONNTRACK_TFTP is not set

# CONFIG_NF_CT_NETLINK is not set

# CONFIG_NF_CT_NETLINK_TIMEOUT is not set

CONFIG_NF_NAT=y

CONFIG_NF_NAT_NEEDED=y

# CONFIG_NF_NAT_AMANDA is not set

# CONFIG_NF_NAT_FTP is not set

# CONFIG_NF_NAT_IRC is not set

# CONFIG_NF_NAT_SIP is not set

# CONFIG_NF_NAT_TFTP is not set

# CONFIG_NETFILTER_TPROXY is not set

CONFIG_NETFILTER_XTABLES=y

#

# Xtables combined modules

#

CONFIG_NETFILTER_XT_MARK=y

CONFIG_NETFILTER_XT_CONNMARK=y

#

# Xtables targets

#

# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set

# CONFIG_NETFILTER_XT_TARGET_CLASSIFY is not set

CONFIG_NETFILTER_XT_TARGET_CONNMARK=y

# CONFIG_NETFILTER_XT_TARGET_DSCP is not set

# CONFIG_NETFILTER_XT_TARGET_HL is not set

# CONFIG_NETFILTER_XT_TARGET_HMARK is not set

# CONFIG_NETFILTER_XT_TARGET_IDLETIMER is not set

# CONFIG_NETFILTER_XT_TARGET_LOG is not set

CONFIG_NETFILTER_XT_TARGET_MARK=y

# CONFIG_NETFILTER_XT_TARGET_NETMAP is not set

CONFIG_NETFILTER_XT_TARGET_NFLOG=y

# CONFIG_NETFILTER_XT_TARGET_NFQUEUE is not set

# CONFIG_NETFILTER_XT_TARGET_RATEEST is not set

CONFIG_NETFILTER_XT_TARGET_REDIRECT=y

# CONFIG_NETFILTER_XT_TARGET_TEE is not set

# CONFIG_NETFILTER_XT_TARGET_TCPMSS is not set

# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set

#

# Xtables matches

#

# CONFIG_NETFILTER_XT_MATCH_ADDRTYPE is not set

# CONFIG_NETFILTER_XT_MATCH_CLUSTER is not set

# CONFIG_NETFILTER_XT_MATCH_COMMENT is not set

# CONFIG_NETFILTER_XT_MATCH_CONNBYTES is not set

# CONFIG_NETFILTER_XT_MATCH_CONNLIMIT is not set

CONFIG_NETFILTER_XT_MATCH_CONNMARK=y

CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y

# CONFIG_NETFILTER_XT_MATCH_CPU is not set

# CONFIG_NETFILTER_XT_MATCH_DCCP is not set

# CONFIG_NETFILTER_XT_MATCH_DEVGROUP is not set

# CONFIG_NETFILTER_XT_MATCH_DSCP is not set

# CONFIG_NETFILTER_XT_MATCH_ECN is not set

# CONFIG_NETFILTER_XT_MATCH_ESP is not set

# CONFIG_NETFILTER_XT_MATCH_HASHLIMIT is not set

# CONFIG_NETFILTER_XT_MATCH_HELPER is not set

# CONFIG_NETFILTER_XT_MATCH_HL is not set

# CONFIG_NETFILTER_XT_MATCH_IPRANGE is not set

# CONFIG_NETFILTER_XT_MATCH_LENGTH is not set

# CONFIG_NETFILTER_XT_MATCH_LIMIT is not set

# CONFIG_NETFILTER_XT_MATCH_MAC is not set

CONFIG_NETFILTER_XT_MATCH_MARK=y

CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y

# CONFIG_NETFILTER_XT_MATCH_NFACCT is not set

# CONFIG_NETFILTER_XT_MATCH_OSF is not set

# CONFIG_NETFILTER_XT_MATCH_OWNER is not set

# CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set

# CONFIG_NETFILTER_XT_MATCH_QUOTA is not set

# CONFIG_NETFILTER_XT_MATCH_RATEEST is not set

# CONFIG_NETFILTER_XT_MATCH_REALM is not set

# CONFIG_NETFILTER_XT_MATCH_RECENT is not set

# CONFIG_NETFILTER_XT_MATCH_SCTP is not set

CONFIG_NETFILTER_XT_MATCH_STATE=y

# CONFIG_NETFILTER_XT_MATCH_STATISTIC is not set

# CONFIG_NETFILTER_XT_MATCH_STRING is not set

# CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set

# CONFIG_NETFILTER_XT_MATCH_TIME is not set

# CONFIG_NETFILTER_XT_MATCH_U32 is not set

# CONFIG_IP_SET is not set

# CONFIG_IP_VS is not set

#

# IP: Netfilter Configuration

#

CONFIG_NF_DEFRAG_IPV4=y

CONFIG_NF_CONNTRACK_IPV4=y

CONFIG_NF_CONNTRACK_PROC_COMPAT=y

# CONFIG_IP_NF_QUEUE is not set

CONFIG_IP_NF_IPTABLES=y

# CONFIG_IP_NF_MATCH_AH is not set

# CONFIG_IP_NF_MATCH_ECN is not set

CONFIG_IP_NF_MATCH_RPFILTER=y

# CONFIG_IP_NF_MATCH_TTL is not set

CONFIG_IP_NF_FILTER=y

CONFIG_IP_NF_TARGET_REJECT=y

# CONFIG_IP_NF_TARGET_ULOG is not set

CONFIG_NF_NAT_IPV4=y

CONFIG_IP_NF_TARGET_MASQUERADE=y

# CONFIG_IP_NF_TARGET_NETMAP is not set

CONFIG_IP_NF_TARGET_REDIRECT=y

# CONFIG_NF_NAT_PPTP is not set

# CONFIG_NF_NAT_H323 is not set

CONFIG_IP_NF_MANGLE=y

# CONFIG_IP_NF_TARGET_CLUSTERIP is not set

# CONFIG_IP_NF_TARGET_ECN is not set

# CONFIG_IP_NF_TARGET_TTL is not set

# CONFIG_IP_NF_RAW is not set

# CONFIG_IP_NF_SECURITY is not set

# CONFIG_IP_NF_ARPTABLES is not set

# CONFIG_IP_DCCP is not set

# CONFIG_IP_SCTP is not set

# CONFIG_RDS is not set

# CONFIG_TIPC is not set

# CONFIG_ATM is not set

# CONFIG_L2TP is not set

# CONFIG_BRIDGE is not set

CONFIG_HAVE_NET_DSA=y

# CONFIG_VLAN_8021Q is not set

# CONFIG_DECNET is not set

# CONFIG_LLC2 is not set

# CONFIG_IPX is not set

# CONFIG_ATALK is not set

# CONFIG_X25 is not set

# CONFIG_LAPB is not set

# CONFIG_WAN_ROUTER is not set

# CONFIG_PHONET is not set

# CONFIG_IEEE802154 is not set

# CONFIG_NET_SCHED is not set

# CONFIG_DCB is not set

CONFIG_DNS_RESOLVER=y

# CONFIG_BATMAN_ADV is not set

# CONFIG_OPENVSWITCH is not set

CONFIG_RPS=y

CONFIG_RFS_ACCEL=y

CONFIG_XPS=y

# CONFIG_NETPRIO_CGROUP is not set

CONFIG_BQL=y

```

----------

## truc

be sure to check the config of your running kernel.

Here is part of my config, may be this can help:

```
$ zgrep _NF_ /proc/config.gz

CONFIG_NF_CONNTRACK=y

CONFIG_NF_CONNTRACK_MARK=y

CONFIG_NF_CONNTRACK_SECMARK=y

CONFIG_NF_CONNTRACK_PROCFS=y

# CONFIG_NF_CONNTRACK_EVENTS is not set

# CONFIG_NF_CONNTRACK_TIMEOUT is not set

# CONFIG_NF_CONNTRACK_TIMESTAMP is not set

# CONFIG_NF_CT_PROTO_DCCP is not set

CONFIG_NF_CT_PROTO_GRE=m

CONFIG_NF_CT_PROTO_SCTP=y

# CONFIG_NF_CT_PROTO_UDPLITE is not set

# CONFIG_NF_CONNTRACK_AMANDA is not set

CONFIG_NF_CONNTRACK_FTP=y

CONFIG_NF_CONNTRACK_H323=m

CONFIG_NF_CONNTRACK_IRC=y

CONFIG_NF_CONNTRACK_BROADCAST=m

CONFIG_NF_CONNTRACK_NETBIOS_NS=m

CONFIG_NF_CONNTRACK_SNMP=m

CONFIG_NF_CONNTRACK_PPTP=m

CONFIG_NF_CONNTRACK_SANE=m

CONFIG_NF_CONNTRACK_SIP=m

CONFIG_NF_CONNTRACK_TFTP=y

CONFIG_NF_CT_NETLINK=y

# CONFIG_NF_CT_NETLINK_TIMEOUT is not set

CONFIG_NF_NAT=m

CONFIG_NF_NAT_NEEDED=y

CONFIG_NF_NAT_PROTO_SCTP=m

# CONFIG_NF_NAT_AMANDA is not set

CONFIG_NF_NAT_FTP=m

CONFIG_NF_NAT_IRC=m

CONFIG_NF_NAT_SIP=m

CONFIG_NF_NAT_TFTP=m

CONFIG_NF_DEFRAG_IPV4=y

CONFIG_NF_CONNTRACK_IPV4=y

CONFIG_NF_CONNTRACK_PROC_COMPAT=y

CONFIG_IP_NF_IPTABLES=y

CONFIG_IP_NF_MATCH_AH=m

# CONFIG_IP_NF_MATCH_ECN is not set

CONFIG_IP_NF_MATCH_RPFILTER=y

# CONFIG_IP_NF_MATCH_TTL is not set

CONFIG_IP_NF_FILTER=y

CONFIG_IP_NF_TARGET_REJECT=y

CONFIG_IP_NF_TARGET_ULOG=y

CONFIG_NF_NAT_IPV4=m

CONFIG_IP_NF_TARGET_MASQUERADE=m

CONFIG_IP_NF_TARGET_NETMAP=m

CONFIG_IP_NF_TARGET_REDIRECT=m

CONFIG_NF_NAT_SNMP_BASIC=m

CONFIG_NF_NAT_PROTO_GRE=m

CONFIG_NF_NAT_PPTP=m

CONFIG_NF_NAT_H323=m

CONFIG_IP_NF_MANGLE=y

# CONFIG_IP_NF_TARGET_CLUSTERIP is not set

# CONFIG_IP_NF_TARGET_ECN is not set

# CONFIG_IP_NF_TARGET_TTL is not set

CONFIG_IP_NF_RAW=y

CONFIG_IP_NF_SECURITY=m

CONFIG_IP_NF_ARPTABLES=m

CONFIG_IP_NF_ARPFILTER=m

CONFIG_IP_NF_ARP_MANGLE=m

CONFIG_NF_DEFRAG_IPV6=y

CONFIG_NF_CONNTRACK_IPV6=y

CONFIG_IP6_NF_IPTABLES=y

CONFIG_IP6_NF_MATCH_AH=m

CONFIG_IP6_NF_MATCH_EUI64=m

CONFIG_IP6_NF_MATCH_FRAG=m

CONFIG_IP6_NF_MATCH_OPTS=m

CONFIG_IP6_NF_MATCH_HL=y

CONFIG_IP6_NF_MATCH_IPV6HEADER=y

CONFIG_IP6_NF_MATCH_MH=y

CONFIG_IP6_NF_MATCH_RPFILTER=y

CONFIG_IP6_NF_MATCH_RT=y

CONFIG_IP6_NF_TARGET_HL=y

CONFIG_IP6_NF_FILTER=y

CONFIG_IP6_NF_TARGET_REJECT=y

CONFIG_IP6_NF_MANGLE=y

CONFIG_IP6_NF_RAW=y

CONFIG_IP6_NF_SECURITY=m

CONFIG_NF_NAT_IPV6=m

CONFIG_IP6_NF_TARGET_MASQUERADE=m

CONFIG_IP6_NF_TARGET_NPT=m

CONFIG_BRIDGE_NF_EBTABLES=m

```

----------

