IPTABLES error “iptables: No chain/target/match by

问题:

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080

When I try to run this command, I run into the error:

iptables: No chain/target/match by that name

My iptables version is v1.4.14. Running debain on linux kernel 3.8.11.

iptables -L outputs:

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             224.0.0.251          udp dpt:mdns
NFQUEUE    udp  --  anywhere             anywhere             NFQUEUE num 10000

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
NFQUEUE    udp  --  anywhere             239.255.255.250      udp dpt:1900 NFQUEUE num 10001
ACCEPT     all  --  anywhere             anywhere             ctstate NEW,RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere

iptables -t nat -L output:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

I have no clue what the problem is, and I looked and nobody else has had this error with this setup.

回答1:

The error means that you are missing the iptables REDIRECT module in the kernel.

Perhaps you compiled the kernel yourself? Then you need to enable/set the option

CONFIG_IP_NF_TARGET_REDIRECT=m

in your kernel config and then

make modules
make modules_install
depmod -ae