Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to forward port 80 to 8080. So I tried to edit /etc/syscongfig/iptables:

-A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

But got:

# service iptables restart
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules: iptables-restore v1.4.7: 
          Line 8 seems to have a -t table  option.

What's the problem? How should it be done?

share|improve this question

Does file /etc/syscongfig/iptables have correct structure for iptables-restore?

Try to add this rule manually to firewall

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

And compare /etc/sysconfig/iptables with output of iptables-save command

share|improve this answer

This is your iptables rule:

-A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

But I believe it should be something like this instead:

-A PREROUTING -t nat -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080

Note the -m tcp is added. While -p tcp matches the protocol of the rule or of the packet to check, -m tcp explicitly tells IPTables to match a TCP packet. It seems confusing, but from all I know, -p tcp needs to be paired with -m tcp when port specific rules are invoked.

If someone else can expand the rationale/logic behind this requirement please chime in about it in the comments.

share|improve this answer
The -m tcp is added automatically because -p tcp is specified. You can see this when you execute iptables-save. While iptables can be quite complex, it does its best to aid the user. – Daniel B Jan 2 at 19:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.