Iptables: how to redirect locally-generated packets to a remote server?
 

I'm trying to workaround a limitation in a server application. The limitation is that I can only connect to a LOCAL mysql database. I am trying to fool the server in to using a remote mysql database. I was hoping to do this by simply forwarding 3306 to another server on the same subnet.

To that end I've set up iptables rules to forward all connections to port 3306 to a non-standard mysql port on a remote server. This works, except that I need to deal with the loopback interface in a special way and I'm stuck.


Since locally-generated packets will never hit the PREROUTING rule, you'll need to setup a near identical rule using OUTPUT to make it work. Here is what I've tried:

With all of these rules in place, I can connect to another server and n telnet to 3306 on this server and this results in a response from mysql on the remote server. BUT from this server I cannot 'telnet localhost 3306' and get a mysql connection. When I try that, the telnet connection hangs open with no response.

Here are what my chains look like:

Thanks for any help!

I doubt that local packages traverse the -t nat table. Try the command without the -t option.

Or to just be sure where things are growing dim use something like this.
do this for all the chains.

They do. See chapter 6 of Oskar Andreasson's famous tutorial.

Do an "iptables -nvL -t nat" on your box to see the packet counters with your own eyes. :)

Yes in fact in table 3-2 at http://www.faqs.org/docs/iptables/tr...goftables.html it says:

source of packet = local process
table=nat
chain=output:
Here it is again:
That -t nat OUTPUT rule is:

Without that -t nat OUTPUT rule:
With that -t nat OUTPUT rule:

hmm...

Looking at http://tinyurl.com/yhqr5no I believe that the problem is that once I do the DNAT in -t nat, the packet will not traverse the FORWARD chain. So I think what needs to be done is to resend the packet back to this host so that it originates from eth0 and gets processed by those rules. I tried:

(169.xxx is the ip of this machine.)

...but that's not quite it.

Can you please, explain, what do you mean by: "BUT from this server I cannot 'telnet localhost 3306' and get a mysql connection"

You can easily telnet to different port and then in iptables use REDIRECT to turn packets to localhost ANY port.

The server where I'm modifying iptables is adm-10-cms:

Connecting from a different server:
As you can see I get a response from the remote mysql server when I initiate the connection from dev-10-cms, but I do not when I initiate the connection from adm-10-cms. I need to be able to initate the connection from adm-10-cms.

(Mysql is not running on adm-10-cms. I am definitley getting a response from the 128.xxx box mentioned above.)

If fails when you telnet to localhost port 3306, right?

I'd _guess_ it's because you do a DNAT but probably the source IP address that's set on those packets is still set to 127.0.0.1, isn't that right?

Try snatting or masquerading all traffic to the real mysql server so that it sees your IP address on that network interface, otherwise the mysql server will get 127.0.0.1 as the source address of those packets and won't be able to reply back.

Use REDIRECT rule in iptables to turn local port <ANY> to local port <ANY>.

Are you saying to do what I tried in #5:

but to leave out the "--dport 3306" and remove the ":3306"?

I guess I could try that as a test. In reality I only want mysql connections to go to the real mysql server. Http and other connections should still come to adm-10-cms.

wait, wait, you confuse me.
nat -A OUTPUT - is located BEFORE router. So, you need to do things different way.

You need to connect to port 3306 on local and remote host - no problems.
But you need separate connections. In that case you can choose port 3306 for local and 4444 for remote server.
Now your iptables rules should be next:
iptables -t nat -A OUTPUT -p tcp -o lo --dport 4444 -j DNAT --to 169.xxx.xxx.xxx:3306

Now packets to port 3306 will not match any rules and go to local host as it suppose to be.
But packets to 4444 will match our rule and NAT will change destination.

Sure... just add filters to the rule in -t nat POSTROUTING that will match only traffic you care to masquerade/snat.

And just to make sure: it fails when you try to connect to telnet localhost 3306 (which is supposed to end up connecting to a remote mysql server), is that right?

But I'm seeing in your rules that you are masquerading all traffic that's going out... so the problem is not what I'm describing. Let me read it again to see what's going on.

can you do a tcpdump on your network interface that connects to the nerwork where the remote mysql server is?

something like:
tcpdump -i blah -p tcp and port 3197 -n -v

and then try to do the telnet and see what addresses/ports are showing up?

Thanks eantoraz,

First I setup my rules again:

Here's tcpdump of a a successfull connection: 'telnet adm-10-cms 3306' initiated from dev-10-cms

When I try to capture the unsuccessful connection from localhost I don't get any output. I do:

then:

Nothing appears in the tcpdump console, so I ^C and get:

Next I try to listen on 3306 on the lo interface, but nothing comes across when I telnet localhost 3306

Trying the same thing to 3307 (no service there) I get this tcpdump output:

For the last test I remove the -t nat OUTPUT rule and listen on 3306 while attempting the same telnet localhost 3306. This yields expected output.

With the rules you set in place, do the tcpdump on -i lo and try the telnet localhost 3306 and tell us what comes out.

And is the counter of the -t nat OUTPUT rule you set increasing when you do the telnet?

Oh, I saw you tried the tcpdump listening on -i lo so skip that test for now. Tell me about the counter, because that traffic must be going somewhere, right?

I would think that the problem here is that there's code on the network stack doing checkups after OUTPUT that when looking at the packet (source address: 127.0.0.1, dest addres: something not in loopback) drops it for not being "consistent".... perhaps someone knows about this? And perhaps could sysconf be used to disable such checkup?

When I do

and then 'telnet localhost 3306' in a different console on the same server nothing is captured.

The counter is incrementing. I see:

I do another telnet localhost and then I see it's at 8:

I really appreciate all your help thus far!

What do you think of my theory here:
http://www.linuxquestions.org/questi...21#post3909121

Since this is a locally-generated packet it is never going to hit this rule

which does the actual forwarding. I *think* that this rule:

only rewrites the destination of the packet. We need the forward rule above to actually send the packet on...

Well, FORWARD is not touched by packets that are going out from OUTPUT so don't worry cause it doesn't affect you.

I think it's because of the source address inconsistency, I think. Check out this article I just found (a little dated, by the way):

http://lists.netfilter.org/pipermail...er/040104.html

So, how about other tricks? Why do you need locally generated connections on local port 3306 to get connected to a remote host in the first place? In case it's a _must_, wouldn't a SSH tunnel (or a simpler approach) work for you?

In case you want to try the ssh runnel trick, remove the OUTPUT rule doing the DNAT to remote:3197 and run this command on that same host:

ssh -nNT -L 3306:remote-server:3197 user@localhost

After the connection is established (you will know because after a few seconds the command won't return), try telnet localhost 3306

Maybe there are simpler approaches but _at least_ I bet that one will work.

It _has_ to be the IP address inconsistency.

With all your rules in place, try to do a telnet to your local IP address on the intranet (instead of localhost). That way, it did work with your DNAT trick.

At least, it did work for me.

Thought of that. The remote mysql server doesn't allow ssh and I don't have control over that server.

Is there a non ssh option for setting up a simple tunnel to 3197 on the remote server?

Will try telnet to ipaddr tomorrow and report back. If that works, I may look into snat.

Thanks.;

The ssh tunnel as I told you to use it yesterday requires no ssh on the mysql server but on the host you are working instead (the one where you want local connections to port 3306 to be sent to a remote server port 3197).

Thanks again for all the help!

You are right. Telnetting to anything other than localhost works:

So if you snatted the localhost packets correctly, this could probably be made to work from localhost via the loopback interface.

Thanks for enlightening me on the ssh tunnel. I assumed that you needed sshd running on the target server. Since you don't I'm pursuing this option since it is way simpler. Always good to know more about iptables though!

I think your problem is really solved here (I mean, solved the iptables way) :

http://unix.stackexchange.com/questi...s-to-127-0-0-1

you need to activate local routing on your outbound interface. if eth0 :

sysctl -w net.ipv4.conf.eth0.route_localnet=1

it seems to be like security feature

hope it helps some people coming to this question !