Forwarding an IP to a different port

PetruM · 06-20-2008, 08:44 AM

Hello.

Code:

iptables -t nat -A PREROUTING -p tcp --dport 23 -j DNAT --to-destination 192.168.0.41

I understand that the above command forwards connections on port 23 to 192.168.0.41 on port 23. This isn't exactly what I need. I'm looking for something that will allow me to forward connections on port 23 to 192.168.0.41 on port 80, for example.

Any help is appreciated.

avalonit · 06-20-2008, 09:00 AM

192.168.0.41:80 works?

PetruM · 06-20-2008, 09:51 AM

I'll give it a try soon. Thanks!

theNbomr · 06-20-2008, 05:21 PM

This might work.

Code:

# Set WAN to receiving interface
WAN=eth0
iptables -t nat -A PREROUTING -p tcp -i $WAN --dport 23 -j DNAT --to 192.168.0.41:80
iptables -A FORWARD -p tcp -i $WAN -d 192.168.0.41 --dport 80 -j ACCEPT

Besides mangling the packet to make it look acceptable to the target host (what nat + PREROUTING does), you also need a rule to make it get sent there (what filter + FORWARD does).
--- rod.

PetruM · 06-21-2008, 07:38 AM

The first one seems to do the job.
Thanks to both!

wag2639 · 06-23-2008, 11:46 AM

I'm trying to do this with an SSH port and it doesn't seem to be working (swapping out port 80 with port 22 and using the appropriate IP).

Am I suppose to put the rules into a config file or something.

Thanks

theNbomr · 06-23-2008, 03:57 PM

You can run the commands, as root, from a commandline. Most installations have a script or scripts to configure firewalls, routers, etc., and the commands could be placed in an appropriate spot within one of those scripts. It would be up to you to figure out where they would best fit. Many such scripts are built from GUI tools or canned firewall scripts. Using the GUI or the documentation & comments embedded in existing scripts might give you some clues. The commands that I provided came from the homeLANSecurity package that I use.
--- rod.