iptables: if connected to localhost, forward to remote ip

sl_king · 08-19-2005, 02:28 PM

Hi All,

Here is the problem I'm trying to solve by iptables. I need to forward local tcp connections to remote host. Let's say there are 2 hosts : 192.168.1.1 and 192.168.1.2.

When somebody tries to connect to 192.168.1.1:22, I want this connection to be redirected to 192.168.1.2:2244. This would be a simple port forwarding, but I want this to be active for localhost. I.e. when I execute "telnet localhost 22" from within 192.168.1.1, I want to end up connecting to 192.168.1.2:2244.

How to configure this with iptables?

Thanks!

peter_robb · 08-19-2005, 05:34 PM

Try..
iptables -t nat -I PREROUTING -i lo -d 127.0.0.1 -p tcp --dport 22 -j DNAT --to-destination 192.168.1.2:2244

It will be important which rule number this is to make sure nothing before it takes it out of the chain, so this will place the rule first, and you can put it in it's correct position later.

sl_king · 08-19-2005, 06:22 PM

Code:

iptables -t nat -I PREROUTING -i lo -d 127.0.0.1 -p tcp --dport 22 -j DNAT --to-destination 192.168.1.2:2244

iptables does not compain, but does not work, either...

Code:

root@dev-2# telnet localhost 22
Trying ::1...
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused

Service is running at 192.168.1.2:2244. I mean "telnet 192.168.1.2 2244" connects.

Any other ideas?..

peter_robb · 08-19-2005, 06:36 PM

The replying packets need to be natted to look like they are from 127.0.0.1..

That will take some extra trickery..
WIll have to think some more..

peter_robb · 08-19-2005, 06:52 PM

Add a log rule to the outgoing interface to see what source ip address is being used..

iptables -t nat -A POSTROUTING -o eth? -d 192.168.1.2 --dport 2244 -j LOG --log-level 6 --log-prefix "checkme "

If the packets are leaving with 127.0.0.1 as a source address, add..
iptables -t nat -A POSTROUTING -o eth? -d 192.168.1.2 --dport 2244 -j MASQUERADE

(Ideally, it should be a SNAT rule with the appropriate ip number of the interface..)