how to port forward with iptables

fancylad · 05-31-2009, 01:24 PM

i am using debian etch as my gateway for my home network. eth1 is connected to my isp. eth0 is connected to my LAN. in order to share an internet connection i use:

Quote:

iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE

i have been trying to port forward incoming port 25 to 192.168.1.222:25. from what i have read online i have tried:

Quote:

sudo iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 25 -j DNAT --to 192.168.1.222:25

this however does not work. if i try connecting with telnet it never connects. if i do examine the packets on 192.168.1.222 however i can see that the packets are getting there. it just seems like they can't get back. i have tried adding a line like this to the POSTROUTING chain:

Quote:

sudo iptables -t nat -A POSTROUTING -p tcp -j SNAT -s 192.168.1.222 --to <public ip address>:25

and sometimes i am able to connect via telnet to port 25. however after i disconnect and try again it doesn't work.

does anyone know how i can get port forwarding to work?

david1941 · 05-31-2009, 01:47 PM

Are you trying to connect from the same network you DNATed to? That can give a connection problem for traffic going in reverse as explained in this chapter of a good tutorial:

http://iptables.rlworkman.net/chunkyhtml/x4033.html

Dave

fancylad · 05-31-2009, 02:41 PM

never mind. i just found out my isp blocks inbound port 25. i tried this with port 22 and it does work. thanks for your help.