ive done some iptables before, but for some reason im having a problem right now trying to set something simple up...

all i want is to have nat forward www requests to x.x.x.x (eth0) to 192.168.25.4 so people can visit a web server behind the nat.

im using RH8, i have 3 nics in this machine...

eth0 with IP x.x.x.x
eth1 192.168.1.1 (not pluggin into anything)
eth2 192.168.25.1

the web server is at 192.168.25.4

i can ping the web server... i can access the webpage from the firewall. the iptables box can access the outside world and vice versa.

so im thinking htere must be something wrong with either my /etc/sysconfig/iptables or somethign else like my hosts file.

here are the configs:

-----/etc/sysconfig/iptables--------

# Generated by iptables-save on…
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0}
-A PREROUTING –d x.x.x.x –p tcp –m tcp --dport 80 –j DNAT --to-destination 192.168.25.4
-A PREROUTING –s 192.168.25.4/255.255.255.0 –j ACCEPT
-A PREROUTING –d 192.168.25.4/255.255.255.0 –j ACCEPT
-A POSTROUTING –s 192.168.25.4/255.255.255.0 –j MASQUERADE
-A POSTROUTING –s 192.168.25.4/255.255.255.0 –j ACCEPT
-OUTPUT –s 192.168.25.4/255.255.255.0 –j ACCEPT
-OUTPUT –d 192.168.25.4/255.255.255.0 –j ACCEPT

COMMIT
#...
#...
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT –s 192.168.25.4/255.255.255.0 –j ACCEPT
-A INPUT –d 192.168.25.4/255.255.255.0–j ACCEPT
-A FORWARD –d 192.168.25.4/255.255.255.0–j ACCEPT
-A FORWARD –s 192.168.25.4/255.255.255.0 –j ACCEPT
-A OUTPUT –d 192.168.25.4/255.255.255.0 –j ACCEPT
-A OUTPUT –s 192.168.25.4/255.255.255.0 –j ACCEPT
COMMIT

--/etc/hosts----------

127.0.0.1 localhost.localdomain localhost

-------------------------

# netstat -r shows what looks like a correct routing table as well.

any ideas? thanks

bump

You might need to specify the interfaces. To get forwarding to work with my webserver, I did the following:

In the NAT table:
-A PREROUTING -d XXX.XXX.XXX.XXX -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.2

And in the filter table, I have:
-A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 80 -m state --state NEW,RELATED -j ACCEPT
-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -o eth0 -j ACCEPT


So substitute eth1 with eth2 and it should work. Also, you're not editing the actual /etc/sysconfig/iptables directly are you?

no, i am using iptables and iptables-save commands

ill give that a try and let u know how it works.. thanks!

it didnt work,

to test, i started apache on the firewall. then i stopped iptables, and tried to access x.x.x.x via a browser from a computer on a different network. i got to the page on the firewall ok, so then i started iptables back up, and refreshed the browser. ok so if i all went well, it should have fwd'd me to the real webserver behind the firewall... the browser sat there for a while and then replied an error message. so, because the web page on the firewall didnt show up, i can only assume that iptables is trying to do something with port 80 traffic.. but for some reason its not getting to the web server.

are there any other settings i should check?

Flush all of the old rules in the NAT table and set it up like this:
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -d xxx.xxx.xxx.xxx -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.25.4
-A POSTROUTING -o eth0 -j MASQUERADE

Some of those other NAT rules might be the problem. The above NAT rules work for the exactly same setup you have. Make sure to keep the 3 FORWARDING rules that I posted in the filter. You might also want to fireup tcpdump or ethereal and see directly what is happening to the packets. It sounds like they're being forwarded, but not getting back out properly or something. Also set the Apache log level to DEBUG and look at what's going on.
HTH

yeah, i flushed all the chains prior to adding the rules.

tcpdump on eth0 shows the request coming into the firewall...
but tcpdump on eth2 does not show the request passin onto the web server.

Try changing your default OUTPUT policy to ACCEPT. It's usually easier to just filter out all the bad outgoing packets, rather than specifically specify which ones you want to allow out (it can be tricky to do it like that). I didn't catch it the first time I looked at your rules.

im starting to think there might be somethign wrong with something else besides iptables. ive tried a ton of different rules and the same problem each time.