LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 11-30-2011, 10:35 AM   #1
jshailes
LQ Newbie
 
Registered: Nov 2011
Posts: 2

Rep: Reputation: Disabled
How to DNAT with iptables


When x.x.x.x makes a request on port 80 to y.y.y.y I would like the request to be redirected to z.z.z.z:80. I'm trying to do this with iptables under CentOS 6. It might be worth mentioning that to prove the concept x.x.x.x and y.y.y.y are currently in the same local network but later I'll be trying to do this over a VPN with x.x.x.x one side of the VPN and y.y.y.y on the other. z.z.z.z is an external ip.

Before creating any rules, when I go to y.y.y.y:80 from x.x.x.x I can connect to the http server running on y.y.y.y.

I think I've established that I need to create a DNAT rule. I've done this as follows:
Code:
iptables -t nat -A PREROUTING -p tcp -s x.x.x.x -d y.y.y.y --dport 80 -j DNAT --to-destination z.z.z.z:80
When trying to connect to y.y.y.y the connection times out. I realised ip forwarding was disabled, so issued:
Code:
echo 1 > /proc/sys/net/ipv4/ip_forward
This then stops the timeout but still doesn't connect to the http server on z.z.z.z.

Someone suggested that I need to create an SNAT rule because x.x.x.x and y.y.y.y are currently on the same network. I'm not sure if I've done this correctly or not:
Code:
iptables -A POSTROUTING -t nat -s x.x.x.0/24 -o eth0 -j SNAT --to-source x.x.x.x
If anyone has a suggestion on how I can get this working I'd really appreciate their help.

Thanks,

James
 
Old 11-30-2011, 06:46 PM   #2
jshailes
LQ Newbie
 
Registered: Nov 2011
Posts: 2

Original Poster
Rep: Reputation: Disabled
Final solution as follows:

Code:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp -s x.x.x.x -d y.y.y.y --dport 80 -j DNAT --to-destination z.z.z.z:80
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
where eth0 is outside interface on y.y.y.y.
 
Old 12-29-2011, 07:58 PM   #3
lmorda
LQ Newbie
 
Registered: Nov 2011
Location: San Diego
Distribution: Fedora
Posts: 11

Rep: Reputation: Disabled
I am trying to do something very similar. I've got a PC on x.x.x.x, a Linux machine eth0 on y.y.y.y.y, and an embedded device on z.z.z.z. The connected device is running an FTP server, and I am trying to FTP into z.z.z.z from x.x.x.x.

Which interface in your setup is on z.z.z.z? Now that the request is working from x.x.x.x to z.z.z.z, can you also send data back from z.z.z.z to x.x.x.x?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Iptables and DNAT _TeRmInEt_ Linux - Networking 9 11-24-2009 05:56 PM
iptables with dnat mhm Linux - Networking 3 12-31-2007 07:10 AM
Iptables DNAT ! Please help ! thomaspsimon Linux - Networking 18 08-27-2007 10:03 AM
iptables DNAT pshepperd Linux - Security 1 05-22-2004 03:56 PM
iptables DNAT bentz Linux - Networking 15 05-19-2003 01:17 PM


All times are GMT -5. The time now is 04:12 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration