Iptables: why my redirection doesn't work?

Question

Linux slackware,i have put ftp server with unprivileged user running port 2121. Want to redirect all packets from 21 to 2121 so my ftp is avaliable as standard without specify the port.

telnet host 2121 OK

telnet host 21 NO!
ncftp host NO! 

I use this simple rule

iptables -A PREROUTING -p tcp --dport 21 -j REDIRECT --to-port 2121

and modprobe those modules

 modprobe nf_conntrack_ftp
 modprobe ip_nat_ftp
 modprobe ip_conntrack_ftp

interface is br0 and ip_forward is enabled

Why doesn't work?

Answer 1

Solution found i use those rules

#!/bin/sh

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -F
iptables -t nat -F
iptables -X


iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 21 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 2121 -j ACCEPT
iptables -t nat -I PREROUTING -p tcp --dport 21 -j REDIRECT --to-ports 2121
iptables -t nat -I OUTPUT -p tcp -o lo --dport 21 -j REDIRECT --to-ports 2121

And works perfect.

Another firewall configuration can be this

*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i br0 -p tcp --dport 2121 -j DNAT --to-destination 192.168.0.2:21
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 2121 -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -i br0 -m state --state NEW -m tcp -p tcp -d 192.168.0.2 --dport 21 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT