View previous topic :: View next topic |
Author |
Message |
anatolie n00b
Joined: 31 Oct 2007 Posts: 8 Location: Ungheni, Moldova
|
Posted: Wed Oct 31, 2007 8:08 am Post subject: iptables NAT (solved) |
|
|
i try'd all sugestion from this subforum
Quote: |
#iptables -t nat -F
FATAL: Module ip_tables not found.
iptables v1.3.8: can't initialize iptables table 'nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel need to be upgraded.
#dmesg |grep tables
ip_tables: (C) 2000-2006 Netfilter Core Team
arp_tables: (C) 2002 David S. Miller
#more /proc/version
Linux version 2.6.22-gentoo-r8 (root@localhost) (gcc version 4.1.2 (Gentoo 4.1.2 p1.0.2)) #5 SMP Wed Oct 31 12:20:28 EET 2007
#zgrep NAT /proc/config.gz
CONFIG_BRIDGE_EBT_T_NAT=m
CONFIG_BRIDGE_EBT_DNAT=m
CONFIG_BRIDGE_EBT_SNAT=m
CONFIG_NATSEMI=m
#zgrep IPTABLES /proc/config.gz
CONFIG_IP_NF_IPTABLES=y
#zgrep -i netfilter /proc/config.gz
CONFIG_NETFILTER=y
# CONFIG_NETFILTER_DEBUG is not set
CONFIG_BRIDGE_NETFILTER=y
# Core Netfilter Configuration
CONFIG_NETFILTER_NETLINK=m
CONFIG_NETFILTER_NETLINK_QUEUE=m
CONFIG_NETFILTER_NETLINK_LOG=m
CONFIG_NETFILTER_XTABLES=y
CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
CONFIG_NETFILTER_XT_TARGET_DSCP=m
CONFIG_NETFILTER_XT_TARGET_MARK=m
CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
CONFIG_NETFILTER_XT_TARGET_NFLOG=m
CONFIG_NETFILTER_XT_TARGET_SECMARK=m
CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
CONFIG_NETFILTER_XT_MATCH_COMMENT=m
CONFIG_NETFILTER_XT_MATCH_DCCP=m
CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
CONFIG_NETFILTER_XT_MATCH_LIMIT=m
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_POLICY=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
CONFIG_NETFILTER_XT_MATCH_QUOTA=m
CONFIG_NETFILTER_XT_MATCH_REALM=m
CONFIG_NETFILTER_XT_MATCH_SCTP=m
CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
CONFIG_NETFILTER_XT_MATCH_STRING=m
CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
# IP: Netfilter Configuration
# Bridge: Netfilter Configuration
|
what's wrong?
Last edited by anatolie on Wed Nov 07, 2007 4:41 pm; edited 1 time in total |
|
Back to top |
|
|
elestedt Guru
Joined: 13 Mar 2005 Posts: 383
|
|
Back to top |
|
|
Sleipnir Guru
Joined: 20 Sep 2005 Posts: 372 Location: Germany
|
Posted: Wed Oct 31, 2007 8:53 am Post subject: |
|
|
Make sure that NAT is compiled as a module.
Maybe also the Gentoo-HowTo helps... _________________ A)bort, R)etry, I)nfluence with large hammer. |
|
Back to top |
|
|
anatolie n00b
Joined: 31 Oct 2007 Posts: 8 Location: Ungheni, Moldova
|
Posted: Wed Oct 31, 2007 2:52 pm Post subject: |
|
|
ok kernel works
but....
using:http://www.gentoo.org/doc/en/home-router-howto.xml
i have been created rules
but i have no inet access from client
my client on win vista show me beauty icon of network connection with internet
but ping(www, chats nothing) does not work
Quote: | #iptable -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
REJECT udp -- anywhere anywhere udp dpt:bootps reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp dpt:domain reject-with icmp-port-unreachable
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
DROP tcp -- anywhere anywhere tcp dpts:0:1023
DROP udp -- anywhere anywhere udp dpts:0:1023
Chain FORWARD (policy DROP)
target prot opt source destination
DROP all -- anywhere 192.168.0.0/24
ACCEPT all -- 192.168.0.0/24 anywhere
ACCEPT all -- anywhere 192.168.0.0/24
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
|
tcpdump output on gateway
Quote: | 17:19:39.663084 IP host-86-106-240-76.moldtelecom.md.15961 > 192.168.0.100.61363: . ack 3494827815 win 64240
17:19:39.663765 IP 192.168.0.100.61363 > host-86-106-240-76.moldtelecom.md.15961: . 1:1461(1460) ack 0 win 256
17:19:39.663889 IP 192.168.0.100.61363 > host-86-106-240-76.moldtelecom.md.15961: . 1461:2921(1460) ack 0 win 256
17:19:39.765135 IP 192.168.0.100.62331 > host-89-41-67-234.moldtelecom.md.http-alt: S 1918399579:1918399579(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
17:19:39.765200 IP 192.168.0.100.62332 > static.195.22.243.10.mdl.net.62818: S 619155064:619155064(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
17:19:39.765239 IP 192.168.0.100.62333 > 87-248-173-199.starnet.md.64781: S 2650161518:2650161518(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
17:19:39.765274 IP 192.168.0.100.62334 > 89-28-17-84.starnet.md.25035: S 2031341689:2031341689(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
17:19:39.861355 IP static.195.22.243.10.mdl.net.62818 > 192.168.0.100.62332: R 0:0(0) ack 619155065 win 0
17:19:40.355110 IP 192.168.0.100.62332 > static.195.22.243.10.mdl.net.62818: S 619155064:619155064(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
17:19:40.427519 IP host-86-106-240-76.moldtelecom.md.15961 > 192.168.0.100.61363: . ack 2921 win 64240
17:19:40.428090 IP 192.168.0.100.61363 > host-86-106-240-76.moldtelecom.md.15961: . 2921:4381(1460) ack 0 win 256
17:19:40.428213 IP 192.168.0.100.61363 > host-86-106-240-76.moldtelecom.md.15961: . 4381:5841(1460) ack 0 win 256
17:19:40.428347 IP 192.168.0.100.61363 > host-86-106-240-76.moldtelecom.md.15961: . 5841:7301(1460) ack 0 win 256
17:19:40.428461 IP 192.168.0.100.61363 > host-86-106-240-76.moldtelecom.md.15961: . 7301:8761(1460) ack 0 win 256
17:19:40.447633 IP static.195.22.243.10.mdl.net.62818 > 192.168.0.100.62332: R 0:0(0) ack 1 win 0
17:19:40.765150 IP 192.168.0.100.62335 > host-86-106-214-105.moldtelecom.md.41089: S 1463094154:1463094154(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
17:19:40.945132 IP 192.168.0.100.62332 > static.195.22.243.10.mdl.net.62818: S 619155064:619155064(0) win 8192 <mss 1460,nop,nop,sackOK>
17:19:41.166399 IP host-86-106-240-76.moldtelecom.md.15961 > 192.168.0.100.61363: . ack 5841 win 64240
17:19:41.166970 IP 192.168.0.100.61363 > host-86-106-240-76.moldtelecom.md.15961: . 8761:10221(1460) ack 0 win 256 |
192.168.0.1 gw
192.168.0.100 client
host-86-106-240-76.moldtelecom.md my ISP
static.195.22.243.10.mdl.net other ISP company
whats wrong? |
|
Back to top |
|
|
elestedt Guru
Joined: 13 Mar 2005 Posts: 383
|
Posted: Wed Oct 31, 2007 3:16 pm Post subject: |
|
|
A wild quess says that somethings wrong with your DNS lookup.
Try to, from your client, ping one of the IP addresses for www.google.com.
Find it by pinging www.google.com on your gateway...
If that works I would recommend checking /etc/resolv.conf on your client.
If your nameserver is your gateway, you need to add a DNS proxy/cache to your gateway. Have a look a dnsmasq |
|
Back to top |
|
|
anatolie n00b
Joined: 31 Oct 2007 Posts: 8 Location: Ungheni, Moldova
|
Posted: Wed Oct 31, 2007 6:48 pm Post subject: |
|
|
i cheked up access website by ip
it does not work
any other ideas? |
|
Back to top |
|
|
Hu Administrator
Joined: 06 Mar 2007 Posts: 23062
|
Posted: Thu Nov 01, 2007 1:16 am Post subject: |
|
|
Post the output of iptables-save -c, which is more complete than iptables -L. Is the tcpdump output from your internal (LAN) interface or your external (WAN) interface? Traffic sent to your ISP should not have a 192.168.x.x address. If it does, the request will not work.
As a blind shot before seeing your rules, add a masquerade rule: iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -j MASQUERADE. |
|
Back to top |
|
|
anatolie n00b
Joined: 31 Oct 2007 Posts: 8 Location: Ungheni, Moldova
|
Posted: Thu Nov 01, 2007 6:43 am Post subject: |
|
|
solved
thx --world
|
|
Back to top |
|
|
Zucca Moderator
Joined: 14 Jun 2007 Posts: 3895 Location: Rasi, Finland
|
Posted: Wed Nov 07, 2007 7:46 pm Post subject: I cannot get iptables working. I need NAT but... |
|
|
Sleipnir wrote: | Make sure that NAT is compiled as a module.
Maybe also the Gentoo-HowTo helps... |
Code: | zgrep -i "ip_nf" /proc/config.gz
# CONFIG_IP_NF_QUEUE is not set
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_MATCH_IPRANGE=m
CONFIG_IP_NF_MATCH_TOS=m
CONFIG_IP_NF_MATCH_RECENT=m
CONFIG_IP_NF_MATCH_ECN=m
CONFIG_IP_NF_MATCH_AH=m
CONFIG_IP_NF_MATCH_TTL=m
CONFIG_IP_NF_MATCH_OWNER=m
CONFIG_IP_NF_MATCH_ADDRTYPE=m
CONFIG_IP_NF_FILTER=m
CONFIG_IP_NF_TARGET_REJECT=m
CONFIG_IP_NF_TARGET_LOG=m
# CONFIG_IP_NF_TARGET_ULOG is not set
CONFIG_IP_NF_MANGLE=m
CONFIG_IP_NF_TARGET_TOS=m
CONFIG_IP_NF_TARGET_ECN=m
CONFIG_IP_NF_TARGET_TTL=m
CONFIG_IP_NF_RAW=m
# CONFIG_IP_NF_ARPTABLES is not set | As you can see. No such option.
Code: | uname -a
Linux zelan 2.6.22-gentoo-r8 #5 Wed Nov 7 18:54:02 EET 2007 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux |
iptables fails as I try following commands: Code: | iptables -P FORWARD ACCEPT && iptables -A OUTPUT -o eth0 -j ACCEPT && iptables -A INPUT -i eth0 -j ACCEPT && iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
iptables v1.3.8: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded. |
I've compiled kernel, modules and iptables many times (I've also googled;) ).
Any help?
- Zucca _________________ ..: Zucca :..
My gentoo installs: | init=/sbin/openrc-init
-systemd -logind -elogind seatd |
Quote: | I am NaN! I am a man! |
|
|
Back to top |
|
|
elestedt Guru
Joined: 13 Mar 2005 Posts: 383
|
Posted: Mon Nov 12, 2007 12:37 pm Post subject: Re: I cannot get iptables working. I need NAT but... |
|
|
Zucca wrote: | Sleipnir wrote: | Make sure that NAT is compiled as a module.
Maybe also the Gentoo-HowTo helps... |
Code: | zgrep -i "ip_nf" /proc/config.gz
# CONFIG_IP_NF_QUEUE is not set
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_MATCH_IPRANGE=m
CONFIG_IP_NF_MATCH_TOS=m
CONFIG_IP_NF_MATCH_RECENT=m
CONFIG_IP_NF_MATCH_ECN=m
CONFIG_IP_NF_MATCH_AH=m
CONFIG_IP_NF_MATCH_TTL=m
CONFIG_IP_NF_MATCH_OWNER=m
CONFIG_IP_NF_MATCH_ADDRTYPE=m
CONFIG_IP_NF_FILTER=m
CONFIG_IP_NF_TARGET_REJECT=m
CONFIG_IP_NF_TARGET_LOG=m
# CONFIG_IP_NF_TARGET_ULOG is not set
CONFIG_IP_NF_MANGLE=m
CONFIG_IP_NF_TARGET_TOS=m
CONFIG_IP_NF_TARGET_ECN=m
CONFIG_IP_NF_TARGET_TTL=m
CONFIG_IP_NF_RAW=m
# CONFIG_IP_NF_ARPTABLES is not set | As you can see. No such option.
Code: | uname -a
Linux zelan 2.6.22-gentoo-r8 #5 Wed Nov 7 18:54:02 EET 2007 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux |
iptables fails as I try following commands: Code: | iptables -P FORWARD ACCEPT && iptables -A OUTPUT -o eth0 -j ACCEPT && iptables -A INPUT -i eth0 -j ACCEPT && iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
iptables v1.3.8: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded. |
I've compiled kernel, modules and iptables many times (I've also googled;) ).
Any help?
- Zucca |
You need the the following:
Code: | Symbol: NF_NAT [=n] │
│ Prompt: Full NAT │
│ Defined at net/ipv4/netfilter/Kconfig:183 │
│ Depends on: NET && INET && NETFILTER && IP_NF_IPTABLES && NF_CONNTRACK_I │
│ Location: │
│ -> Networking │
│ -> Networking support (NET [=y]) │
│ -> Networking options │
│ -> Network packet filtering framework (Netfilter) (NETFILTER [=n │
│ -> IP: Netfilter Configuration │
│ -> IP tables support (required for filtering/masq/NAT) (IP_N │
|
Did you look at the guide I posted further up? |
|
Back to top |
|
|
Zucca Moderator
Joined: 14 Jun 2007 Posts: 3895 Location: Rasi, Finland
|
Posted: Mon Nov 12, 2007 9:31 pm Post subject: |
|
|
Yes.
I have enabled support for all but ULOG.
I just need to get past this error: Code: | iptables v1.3.8: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded. |
_________________ ..: Zucca :..
My gentoo installs: | init=/sbin/openrc-init
-systemd -logind -elogind seatd |
Quote: | I am NaN! I am a man! |
|
|
Back to top |
|
|
elestedt Guru
Joined: 13 Mar 2005 Posts: 383
|
Posted: Tue Nov 13, 2007 7:49 am Post subject: |
|
|
Zucca wrote: | Yes.
I have enabled support for all but ULOG.
I just need to get past this error: Code: | iptables v1.3.8: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded. |
|
Have you enabled IP_NF_TARGET_MASQUERADE? |
|
Back to top |
|
|
Zucca Moderator
Joined: 14 Jun 2007 Posts: 3895 Location: Rasi, Finland
|
Posted: Tue Nov 13, 2007 12:06 pm Post subject: |
|
|
There's no such option: Code: | zgrep -i IP_NF /proc/config.gz
# CONFIG_IP_NF_QUEUE is not set
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_MATCH_IPRANGE=m
CONFIG_IP_NF_MATCH_TOS=m
CONFIG_IP_NF_MATCH_RECENT=m
CONFIG_IP_NF_MATCH_ECN=m
CONFIG_IP_NF_MATCH_AH=m
CONFIG_IP_NF_MATCH_TTL=m
CONFIG_IP_NF_MATCH_OWNER=m
CONFIG_IP_NF_MATCH_ADDRTYPE=m
CONFIG_IP_NF_FILTER=m
CONFIG_IP_NF_TARGET_REJECT=m
CONFIG_IP_NF_TARGET_LOG=m
# CONFIG_IP_NF_TARGET_ULOG is not set
CONFIG_IP_NF_MANGLE=m
CONFIG_IP_NF_TARGET_TOS=m
CONFIG_IP_NF_TARGET_ECN=m
CONFIG_IP_NF_TARGET_TTL=m
CONFIG_IP_NF_RAW=m
# CONFIG_IP_NF_ARPTABLES is not set |
I wonder what that IP_NF_QUEUE is... I have enabled all using menuconfig... _________________ ..: Zucca :..
My gentoo installs: | init=/sbin/openrc-init
-systemd -logind -elogind seatd |
Quote: | I am NaN! I am a man! |
|
|
Back to top |
|
|
elestedt Guru
Joined: 13 Mar 2005 Posts: 383
|
Posted: Tue Nov 13, 2007 12:37 pm Post subject: |
|
|
Zucca wrote: | There's no such option: Code: | zgrep -i IP_NF /proc/config.gz
# CONFIG_IP_NF_QUEUE is not set
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_MATCH_IPRANGE=m
CONFIG_IP_NF_MATCH_TOS=m
CONFIG_IP_NF_MATCH_RECENT=m
CONFIG_IP_NF_MATCH_ECN=m
CONFIG_IP_NF_MATCH_AH=m
CONFIG_IP_NF_MATCH_TTL=m
CONFIG_IP_NF_MATCH_OWNER=m
CONFIG_IP_NF_MATCH_ADDRTYPE=m
CONFIG_IP_NF_FILTER=m
CONFIG_IP_NF_TARGET_REJECT=m
CONFIG_IP_NF_TARGET_LOG=m
# CONFIG_IP_NF_TARGET_ULOG is not set
CONFIG_IP_NF_MANGLE=m
CONFIG_IP_NF_TARGET_TOS=m
CONFIG_IP_NF_TARGET_ECN=m
CONFIG_IP_NF_TARGET_TTL=m
CONFIG_IP_NF_RAW=m
# CONFIG_IP_NF_ARPTABLES is not set |
I wonder what that IP_NF_QUEUE is... I have enabled all using menuconfig... |
If you have enabled all in menuconfig then it should exist. In menuconfig it is located here:
Code: | │ Symbol: IP_NF_TARGET_MASQUERADE [=n] │
│ Prompt: MASQUERADE target support │
│ Defined at net/ipv4/netfilter/Kconfig:198 │
│ Depends on: NET && INET && NETFILTER && NF_NAT │
│ Location:
│ -> Networking
│ -> Networking support (NET [=y]) │
│ -> Networking options │
│ -> Network packet filtering framework (Netfilter) (NETFILTER [=y]) │
│ -> IP: Netfilter Configuration │
│ -> IP tables support (required for filtering/masq/NAT) (IP_NF_IPTABLES [=y]) │
│ -> Full NAT (NF_NAT [=y]) │ |
In short, you have to enable all that 'Depends on' indicates, and all they depend on; then it should be visible ans selectable (it is here and I'm running the same kernel). |
|
Back to top |
|
|
Zucca Moderator
Joined: 14 Jun 2007 Posts: 3895 Location: Rasi, Finland
|
Posted: Tue Nov 13, 2007 4:06 pm Post subject: |
|
|
All the depencies met the criteria: Code: | zegrep "CONFIG_NET(=| )|CONFIG_INET(=| )|CONFIG_NETFILTER(=| )|CONFIG_IP_NF_IPTABLES(=| )|CONFIG_NF_CONNTRACK_IPV4(=| )" /proc/config.gz
CONFIG_NET=y
CONFIG_INET=y
CONFIG_NETFILTER=y
CONFIG_IP_NF_IPTABLES=m |
And one didn't found at all..? (CONFIG_NF_CONNTRACK_IPV4)
Menuconfig says that it needs CONFIG_NF_CONNTRACK_IPV4, but it cannot be found. O.o I tried also with menuconfig's search. _________________ ..: Zucca :..
My gentoo installs: | init=/sbin/openrc-init
-systemd -logind -elogind seatd |
Quote: | I am NaN! I am a man! |
|
|
Back to top |
|
|
elestedt Guru
Joined: 13 Mar 2005 Posts: 383
|
Posted: Tue Nov 13, 2007 5:06 pm Post subject: |
|
|
Zucca wrote: | All the depencies met the criteria: Code: | zegrep "CONFIG_NET(=| )|CONFIG_INET(=| )|CONFIG_NETFILTER(=| )|CONFIG_IP_NF_IPTABLES(=| )|CONFIG_NF_CONNTRACK_IPV4(=| )" /proc/config.gz
CONFIG_NET=y
CONFIG_INET=y
CONFIG_NETFILTER=y
CONFIG_IP_NF_IPTABLES=m |
And one didn't found at all..? (CONFIG_NF_CONNTRACK_IPV4)
Menuconfig says that it needs CONFIG_NF_CONNTRACK_IPV4, but it cannot be found. O.o I tried also with menuconfig's search. |
I have that one here:
Code: | │ Symbol: NF_CONNTRACK_IPV4 [=y]
│ Prompt: IPv4 connection tracking support (required for NAT)
│ Defined at net/ipv4/netfilter/Kconfig:8
│ Depends on: NET && INET && NETFILTER && NF_CONNTRACK
│ Location:
│ -> Networking
│ -> Networking support (NET [=y])
│ -> Networking options
│ -> Network packet filtering framework (Netfilter) (NETFILTER [=y])
│ -> IP: Netfilter Configuration
|
|
|
Back to top |
|
|
Zucca Moderator
Joined: 14 Jun 2007 Posts: 3895 Location: Rasi, Finland
|
Posted: Tue Nov 13, 2007 8:59 pm Post subject: |
|
|
I don't get this.
I have enabled every option that is needed.
Here's how it shows up in my menuconfig _________________ ..: Zucca :..
My gentoo installs: | init=/sbin/openrc-init
-systemd -logind -elogind seatd |
Quote: | I am NaN! I am a man! |
|
|
Back to top |
|
|
elestedt Guru
Joined: 13 Mar 2005 Posts: 383
|
Posted: Fri Nov 16, 2007 10:47 am Post subject: |
|
|
Right above 'IP tables support' you should have 'IPv4 connection tracking support (required for NAT)' what does that say?
If you don't have that, then there's some config options missing elsewhere.
Sorry for the long response time |
|
Back to top |
|
|
|