I'd like to forward port 80 to 8080. So I tried to edit /etc/syscongfig/iptables:

-A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

But got:

# service iptables restart
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules: iptables-restore v1.4.7: 
          Line 8 seems to have a -t table  option.

What's the problem? How should it be done?

2 Answers 2


Does file /etc/syscongfig/iptables have correct structure for iptables-restore?

Try to add this rule manually to firewall

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

And compare /etc/sysconfig/iptables with output of iptables-save command


This is your iptables rule:

-A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

But I believe it should be something like this instead:

-A PREROUTING -t nat -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080

Note the -m tcp is added. While -p tcp matches the protocol of the rule or of the packet to check, -m tcp explicitly tells IPTables to match a TCP packet. It seems confusing, but from all I know, -p tcp needs to be paired with -m tcp when port specific rules are invoked.

If someone else can expand the rationale/logic behind this requirement please chime in about it in the comments.

  • The -m tcp is added automatically because -p tcp is specified. You can see this when you execute iptables-save. While iptables can be quite complex, it does its best to aid the user.
    – Daniel B
    Jan 2, 2016 at 19:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.