iptables not port forwarding

blackfish · 08-14-2010, 03:06 PM

Hi All,

I have a CentOS box which is Internet Facing. It has 3 LAN's connected to it which are for virtual machines.

I want to port forward port 445 to a machine on one of the LAN interfaces. I have tried various ways to get it done, but still cannot access that port from the interface. I definately know device hosting port 445 is live, as I can ping it from the CentOS box and use lynx to access it! (It's a web server)

iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 445 -j DNAT --to-destination 192.168.0.2:445

What am I doing wrong?

Any help will me much appreciated

Cheers,

BF

quanta · 08-15-2010, 08:18 AM

Did you enable packet forwarding?

Code:

cat /proc/sys/net/ipv4/ip_forward

blackfish · 08-15-2010, 11:59 AM

Yes IP forwarding is definately enabled in both /proc/sys/net/ipv4/ip_forward and in /etc/sysctl.conf

nimnull22 · 08-15-2010, 01:56 PM

What about FORWARD chain?
Have you allowed forwarding through it?

blackfish · 08-15-2010, 02:55 PM

Yes I have enabled a forward chain,

Here is my iptables config:

Code:

#!/bin/sh
/sbin/modprobe ip_conntrack_ftp
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
#echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
/sbin/iptables --flush
/sbin/iptables -A INPUT  -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT
/sbin/iptables --policy INPUT   DROP
#/sbin/iptables --policy OUTPUT  ACCEPT
/sbin/iptables --policy FORWARD DROP
/sbin/iptables -A INPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 445 -j DNAT --to 192.168.0.2:445
/sbin/iptables -A FORWARD -p tcp --dport 445 -d 192.168.0.2 -j ACCEPT
/sbin/iptables -A INPUT -j DROP
/sbin/iptables-save

Thanks

BF

nimnull22 · 08-16-2010, 09:34 AM

/sbin/iptables -A FORWARD -p tcp --dport 445 -d 192.168.0.2 -j ACCEPT - it is one way.

I suggest for the test purpose allow all of FORWARD:
/sbin/iptables --policy FORWARD ACCEPT

and then, when you make sure that it works, add certain rules to FORWARD chain

blackfish · 08-18-2010, 11:21 AM

Thanks for advice, I have found the problem.

The CentOS server was not reading the firewall script when you restarted iptables using: service iptables restart

I have fixed this problem by appending my configuration to the firewall script and rebooting the server. It now works perfectly

Thanks

BF