Dear Rusty Russell, First of all, I must apologise if I use a wrong email-adress, but this was the only one I found in the HowTo. The HowTo descripes following: 6.2. Destination NAT ... ## Change destination addresses of web traffic to 5.6.7.8, port 8080. # iptables -t nat -A PREROUTING -p tcp --dport 80 -i eth0 \ -j DNAT --to 5.6.7.8:8080 The "--dport" option is available only if the extended packet matching modules are loaded. Altought the man page says, that the extended packet matching modules are loaded implicity, when -p or --protocol is specified, the only way to load them in Version 1.2.2 is to set the -m option. So the way it works look like this ## Change destination addresses of web traffic to 5.6.7.8, port 8080. # iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -i eth0 \ -j DNAT --to 5.6.7.8:8080 Best regards Ein herzliches Servus aus Wien André Dostal mailto: ad7@gmx.at