LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 02-08-2013, 04:49 PM   #1
MrUnix
LQ Newbie
 
Registered: Feb 2013
Posts: 6

Rep: Reputation: Disabled
iptables


I have the current configuration but can't get iptables working.

Computer A
eth0 -> WAN
eth1 -> LAN -> Computer B & Computer C

Computer A (eth1), Computer B and Computer C are on 192.168.*.* IPs and B & C are running VNC servers on 5900 (Windows).

I want to forward and redirect ports 5900 from B & C to ports accessible from the WAN on Computer A?

Any suggestions on the correct iptables syntax? IPv4 port forwarding is enabled.
 
Old 02-08-2013, 05:20 PM   #2
jnielsen7
LQ Newbie
 
Registered: Feb 2013
Posts: 23

Rep: Reputation: Disabled
Will the traffic be directed to/from your WAN machine through a gateway server? If so, before you make an iptables rule, you could test network connectivity and what ports are involved by using an ssh tunnel to port-forward the traffic from the remote port 5900 to your local machine (Computer A) at some arbitrary local port through the gateway server (you will need a login to that server however).

If you can open up a putty or other ssh terminal on the destination machine you can type:

ssh -L LocalPort:RemoteHostIP:RemoteHostPort username@GatewayHost -N
Like: ssh -L 10000:192.168.12.104:5590 myuser@gateway -N

This will forward traffic from 192.168.12.104:5590 through the gateway to your local machine's port 10000. Perhaps this is not applicable for you though. I often have to deal with jumping through a gateway, hence this is useful for me.

Last edited by jnielsen7; 02-08-2013 at 05:25 PM.
 
Old 02-08-2013, 05:22 PM   #3
jnielsen7
LQ Newbie
 
Registered: Feb 2013
Posts: 23

Rep: Reputation: Disabled
Wait, are you just wanting to know the right sytax or did you need to know what kind of rule to add (what ports to allow traffic on and such)? If the former then my suggestion obviously will not help. Sorry if I misunderstood.
 
Old 02-08-2013, 05:24 PM   #4
MrUnix
LQ Newbie
 
Registered: Feb 2013
Posts: 6

Original Poster
Rep: Reputation: Disabled
I understand I can forward VNC via SSH. I would prefer if Computer A had two ports redirect (eth0) (via iptables) to the VNC servers on the LAN (eth1) from Computers B & C.
 
Old 02-08-2013, 05:39 PM   #5
jnielsen7
LQ Newbie
 
Registered: Feb 2013
Posts: 23

Rep: Reputation: Disabled
Quote:
Originally Posted by MrUnix View Post
I understand I can forward VNC via SSH. I would prefer if Computer A had two ports redirect (eth0) (via iptables) to the VNC servers on the LAN (eth1) from Computers B & C.
Ah I think understand now, you need to take the traffic it receives on one ethernet interface and expose it on the other (which is on a different network?). If this was web traffic this would be a piece of cake (use a reverse proxy) but I'm afraid I've never done anything like this for non-web traffic. Hopefully someone who has done that can make a suggestion. Sorry if I wasted your time (the ssh tunnel was my best idea at the time).

P.S. I assume you've looked at the documentation online for the REDIRECT iptables directive? Maybe this is relevant: http://networking-dummies.com/redire...-with-iptables.
 
Old 02-08-2013, 05:48 PM   #6
MrUnix
LQ Newbie
 
Registered: Feb 2013
Posts: 6

Original Poster
Rep: Reputation: Disabled
I basically need an example of how to do this with iptables.

I don't think the separate NICs are a problem because the routing is setup to direct 192.168.*.* traffic to eth1.

All of the commands I tried didn't work so I'm asking if anyone with experience with this can help.
 
Old 02-08-2013, 08:14 PM   #7
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654
Have a look at the example just before section 7.4.1.

http://www.centos.org/docs/4/html/rh...l-ipt-fwd.html

You will need two rules, one for port 5900, and another for another port such as 5901. So using 5900 connects to host B and 5901 connects to host B.

I assumed you have 1 Internet address and masquerade LAN addresses in Host A's iptable rules.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables can't initialize iptables table `filter': Bad file descriptor donalbane Linux - Networking 2 08-17-2011 08:36 AM
iptables error in android: iptables-save and iptables-restore not working preetb123 Linux - Mobile 5 04-11-2011 01:56 PM
On what basis CHAIN integer values are generated in IPtables under iptables file? haariseshu Linux - Server 3 11-05-2009 04:25 AM
iptables v1.2.9: Unknown arg `/sbin/iptables' Try `iptables -h' or 'iptables --help' Niceman2005 Linux - Security 4 12-29-2005 08:20 PM
My iptables script is /etc/sysconfig/iptables. How do i make this baby execute on boo ForumKid Linux - General 3 01-22-2002 07:36 AM


All times are GMT -5. The time now is 07:28 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration