TomatoUSB

New ISP blocks port 25. I have a couple of clients that are hard-coded to use 25 and 25 only. The mail server I'm attaching to is remote and will accept incoming connections on port 26.

I'm trying to come up with the proper syntax for a command that will do this with Tomato, but I'm getting errors. So far I've tried:

iptables -t nat -A PREROUTING -p tcp —dport 25 -j DNAT —to-port 26
iptables -t nat -I PREROUTING -p tcp –-dport 25 -j REDIRECT –-to-port 26

But I'm just getting errors, like this:

iptables: No chain/target/match by that name

Any tips?

Hi cgallery,

You first have to make a chain policy to accept port 26. The proper syntax would be :

iptables -A INPUT -i interface -p tcp —dport 26 -j ACCEPT
iptables -A PREROUTING -t nat -i interface -p tcp —dport 26 -j REDIRECT —to-port 25

Please look at the port redirection link http://blog.softlayer.com/2011/iptables-tips-and-tricks-port-redirection/ for understanding the concept. Hope it helps.

Have a great day!

P.S: The ISPs these days block SMTP default port because of spamming issues. If you take my advise, adopt IMAP. If its too much for you to handle then SMTP it is. Whatever works best for you my friend.

I would do IMAP, but these utilities don't support it.

So how do I find out what I can substitute for "interface" in your examples? I know I have the WAN, and LAN, and wireless interfaces, but I don't know how to find out what their names are.

I tried "eth1" (what I believe is the name of the wireless network) but I get "iptables: No chain/target/match by that name" on the 2nd command when I try it. First command seems to work okay.

(Thank you for all the help.)

I think I don't have REDIRECT available.

I found this:

(Output from command "cat /proc/net/ip_tables_targets")
IMQ
TRIGGER
TCPMSS
CONNMARK
LOG
MASQUERADE
MARK
REJECT
DNAT
SNAT

So I did a "modprobe ipt_REDIRECT" and now REDIRECT is added to the list.

I found this tidbit at //kb . parallels . com / en / 115410 (remove the spaces to make the link work).

Didn't post #2 aswer the question ?

"Didn't post #2 answer the question?"

Not really. I entered the commands in post #2, and got an error on the 2nd. It boils down to REDIRECT not being available until you do modprobe ipt_REDIRECT.

Also, I'm not sure both commands are necessary as my problem is outbound and not inbound? But I'm not sure, that is why I'm asking questions.

And I don't understand the "-i interface" (should I be substituting something for interface?).

Sorry I'm just not getting it.

On your Tomato routers can you enter those two commands w/o getting an error?

Hi cgallery,

You are absolutely right. The redirect module needs to be loaded and i assumed that you had done that. Correct, i can run these commands without any issues as i had it enabled.

root@unknown:/tmp/home/root# iptables -t nat -I OUTPUT —src 0/0 —dst 192.168.1.1 -p tcp —dport 8080 -j REDIRECT —to-ports 8123
root@unknown:/tmp/home/root#

The result:

root@unknown:/tmp/home/root# iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 38 packets, 1999 bytes)
pkts bytes target prot opt in out source destination
422 28972 WANPREROUTING all — * * 0.0.0.0/0 192.168.1.101
0 0 DROP all — vlan1 * 0.0.0.0/0 192.168.90.0/24
422 28972 upnp all — * * 0.0.0.0/0 192.168.1.101

Chain POSTROUTING (policy ACCEPT 2 packets, 885 bytes)
pkts bytes target prot opt in out source destination
10587 710K MASQUERADE all — * vlan1 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT 8 packets, 1260 bytes)
pkts bytes target prot opt in out source destination
0 0 REDIRECT tcp — * * 0.0.0.0/0 192.168.1.1 tcp dpt:8080 redir ports 8123

Chain WANPREROUTING (1 references)
pkts bytes target prot opt in out source destination
0 0 DNAT icmp — * * 0.0.0.0/0 0.0.0.0/0 to:192.168.90.1

Chain upnp (1 references)
pkts bytes target prot opt in out source destination

Have a great day!