LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 11-10-2004, 07:52 AM   #1
laxy_m
LQ Newbie
 
Registered: Nov 2004
Posts: 2

Rep: Reputation: 0
forwarding packets to multiple computers for different ports


Hello,

I'm almost new to linux.

I have used iptable to forward packets to a windows machine on my LAN.
with the following code

/sbin/iptables -t nat -A PREROUTING -i eth1 -j DNAT --to-destination 192.168.x.x

Where 192.168.x.x is a Local LAN computer.

Now I would like to forward packets to different windows machine on my LAN when I get request on different ports through Static IP address.


Assuming the Static IP to be 194.160.1.1

When some one requests at 194.160.1.1:port1
It should forward packets to 192.168.0.1

similarly request on 194.160.1.1:port2 should forward packets to 192.168.0.3 and so on..

Thanks.

regards,
Laxy
 
Old 11-10-2004, 02:31 PM   #2
Matir
LQ Guru
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Debian, Arch
Posts: 8,507

Rep: Reputation: 128Reputation: 128
/sbin/iptables -t nat -A PREROUTING -i eth1 -j DNAT -p tcp --dport PORTN --to-destination 192.168.x.N

Where PORTN is the port to be forwarded and 192.168.x.N is the internal computer.
 
Old 11-10-2004, 02:32 PM   #3
bignerd
Member
 
Registered: Nov 2004
Distribution: FC1, Gentoo, Mdk 8.1, RH7-8-9, Knoppix, Zuarus rom 3.13
Posts: 98

Rep: Reputation: 15
Very interesting question. Sadly iptables is not capable of this. Iptables does not allow for variables, which is what you would need to have set with some conditional logic in the rule itself.

There are plenty of so-called iptables scripts that use variables but these variables are always interpreted by the shell (bash, sh, csh, etc) long before the rule is actually added to iptables, so all iptables ever sees of these variables is the resultant output not the variable itself. <--- Probably confusing. Sorry.

You could write a do loop script that would add THOUSANDS (65,535 to be exact) of individual rules to iptables to do just what you ask... but that would bring your firewall to a screeching halt since it would have to parse all that before allowing a packet.

-b
 
Old 11-10-2004, 02:46 PM   #4
Matir
LQ Guru
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Debian, Arch
Posts: 8,507

Rep: Reputation: 128Reputation: 128
I'm hoping there wasn't intent for THAT many ports. I interpreted the question as one of the syntax of iptables to make it portbased.
 
Old 11-10-2004, 04:22 PM   #5
bignerd
Member
 
Registered: Nov 2004
Distribution: FC1, Gentoo, Mdk 8.1, RH7-8-9, Knoppix, Zuarus rom 3.13
Posts: 98

Rep: Reputation: 15
Quote:
Originally posted by Matir
I'm hoping there wasn't intent for THAT many ports. I interpreted the question as one of the syntax of iptables to make it portbased.
Hmm.. yeah know.. I don't know. I thought he meant any port when he said "and so on". I could very well be wrong. Course then again if he's saying 192.168.0.1, that being a class c block then the most he could hope for is forwarding from 192.168.0.2 through 254. Long way from all 65k ports eh? Still having 250ish rules would be heck on an even moderately used firewall.

Anyway I still stand by my point that iptables doesn't use variables only the results of variables.

Sorry if I introduced confusion with my confusion. :-)

-b
 
Old 11-10-2004, 07:57 PM   #6
Matir
LQ Guru
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Debian, Arch
Posts: 8,507

Rep: Reputation: 128Reputation: 128
Well.... couldn't it be the class B "192.168.0.0/16"? But yes, in either case, it would not be fun for a firewall. Though my firewall has about 100 rules without any noticable lag. Mostly in the FORWARD and INPUT chains. I guess the whole chain deal helps.
 
Old 11-11-2004, 07:57 AM   #7
laxy_m
LQ Newbie
 
Registered: Nov 2004
Posts: 2

Original Poster
Rep: Reputation: 0
Quote:
posted by bignerd...Hmm.. yeah know.. I don't know. I thought he meant any port when he said "and so on".
Quote:
Originally posted by Matir ...I'm hoping there wasn't intent for THAT many ports. I interpreted the question as one of the syntax of iptables to make it portbased.
I am not sure the syntax like

/sbin/iptables -t nat -A PREROUTING -i eth1 -j DNAT -p tcp --dport PORTN --to-destination 192.168.x.N

will help for multiple different ports to forward packets to different LAN computers.


Here is my modified query.

Assuming the Static IP to be 194.160.1.1

Let the unique ports be 80,81,82

When some one requests at 194.160.1.1:80 It should forward packets to 192.168.0.1
When some one requests at 194.160.1.1:81 It should forward packets to 192.168.0.3
When some one requests at 194.160.1.1:82 It should forward packets to 192.168.0.4

and the list goes similar to the above.

If there are some iptable scripts available online then please guide me where to find a best one.OR any alternative solution for this problem

Thanks,

regards,
Laxy

Last edited by laxy_m; 11-11-2004 at 08:00 AM.
 
Old 11-11-2004, 08:15 AM   #8
Demonbane
LQ Guru
 
Registered: Aug 2003
Location: Sydney, Australia
Distribution: Gentoo
Posts: 1,796

Rep: Reputation: 47
yes the DNAT rule will do what you need
Code:
iptables -t nat -A PREROTUING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.0.1
iptables -t nat -A PREROTUING -i eth1 -p tcp --dport 81 -j DNAT --to 192.168.0.3
iptables -t nat -A PREROTUING -i eth1 -p tcp --dport 82 -j DNAT --to 192.168.0.4
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
2 computers- death to packets sun_girl Linux - Hardware 2 08-28-2005 01:13 PM
Not forwarding packets meadensi Linux - Networking 0 02-08-2005 07:02 PM
Forwarding ACK Packets snufferz Linux - Newbie 0 05-12-2004 02:10 AM
Constant flow of packets between computers thosm Linux - Networking 2 07-30-2003 05:47 AM
pardon the silly question: forwarding packets FROM certain ports? FallenHero Linux - Networking 7 06-18-2002 07:46 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 04:43 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration