iptables nat

kernelvn · 05-03-2005, 06:13 AM

I have 2 pc and I tried to learn how to NAT on those . The fist PC ( 10.0.0.4 ) with iptables and the second (10.0.0.5 ) with apache on it. Now I would like whenerver a http request to 10.0.0.4 , it will forward to 10.0.0.5 and I used :

Quote:

[root@HomeServer sysconfig]# iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
[root@HomeServer sysconfig]# iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 10.0.0.5

Then I tried "http://10.0.0.4" on the 10.0.0.5 , hoping it will redirect back but nothing happend ( ofcause my httpd on 10.0.0.5 in turn on ) . Could you point me out the wrong in the command abouve , thank you

pave · 05-03-2005, 06:30 AM

You need to supply port after redirect too - look at the end of that rule. Also primary destination address as a source of redirect won't do any harm. (-d 10.0.0.4)

iptables -t nat -A PREROUTING -p tcp -d 10.0.0.4 --dport 80 -j DNAT --to 10.0.0.5:80

kernelvn · 05-03-2005, 06:36 AM

did you mean :

Quote:

# iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
# iptables -t nat -A PREROUTING -p tcp -d 10.0.0.4 --dport 80 -j DNAT --to 10.0.0.5:80

I've tried it , but it does'nt work , thank for your answer

kernelvn · 05-03-2005, 11:00 AM

any help ?

Matir · 05-03-2005, 11:38 AM

Because of the way tcp works, you cannot use portforwarding within a LAN.

Basically, a packet will be sent from 10.0.0.5 to 10.0.0.4, which redirects it to 10.0.0.5 again. HOWEVER, 10.0.0.5 will reply to 10.0.0.5 directly! 10.0.0.5 is expecting the reply from 10.0.0.4, so will discard this excess packet!

kernelvn · 05-03-2005, 11:39 AM

ya , thank