LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 04-20-2011, 07:48 AM   #1
diogosalazar
LQ Newbie
 
Registered: Mar 2011
Posts: 8

Rep: Reputation: 0
Smile IPtables port forwarding


Hi!

I have a computer with two interfaces eth0(LAN) and eth1(WAN).

I have followed some guides on the internet and came up with this iptables configuration:

# Generated by iptables-save v1.4.4 on Wed Apr 20 09:43:12 2011
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp -i eth0 --dport 80 -j REDIRECT --to-ports 3128
-A PREROUTING -p tcp -m tcp -i eth1 --dport 80 -j DNAT --to-destination 192.168.0.254:80
-A POSTROUTING -o eth1 -j MASQUERADE
COMMIT
# Completed on Wed Apr 20 09:43:12 2011
# Generated by iptables-save v1.4.4 on Wed Apr 20 09:43:12 2011
*mangle
:PREROUTING ACCEPT [448:61429]
:INPUT ACCEPT [370:36685]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [330:136355]
:POSTROUTING ACCEPT [330:136355]
COMMIT
# Completed on Wed Apr 20 09:43:12 2011
# Generated by iptables-save v1.4.4 on Wed Apr 20 09:43:12 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i eth1 -p icmp -m icmp --icmp-type any -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -i lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -i eth0 -p icmp -m icmp --icmp-type any -j ACCEPT
-A INPUT -m limit --limit 5/sec -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT
COMMIT
# Completed on Wed Apr 20 09:43:12 2011


The computer is the network gateway. I have Apache installed in it.
How can I forward HTTP requests on eth1 to the Apache server (port 80)?

It is currently not working.

Thanks in advance
 
Old 04-20-2011, 05:10 PM   #2
T3RM1NVT0R
Senior Member
 
Registered: Dec 2010
Location: Internet
Distribution: Linux Mint, Ubuntu, SLES, CentOS
Posts: 1,753

Rep: Reputation: 320Reputation: 320Reputation: 320Reputation: 320
@ Reply

As I can understand the server in picture is a network gateway. You have installed Apache on it and you want this server to act as webserver.

As you said it is not working does that mean you are able to access default http page within the network but not from outside network/internet?

Paste the IP addresses/configuration of both eth0 and eth1 in the thread.

Paste the http.conf contents here in the thread.
 
Old 04-20-2011, 05:46 PM   #3
sibe
Member
 
Registered: Apr 2011
Location: Jakarta, Indonesia
Distribution: Fedora, CentOS
Posts: 122

Rep: Reputation: 21
Quote:
Originally Posted by diogosalazar View Post
-A INPUT -i eth1 -p icmp -m icmp --icmp-type any -j DROP
Sorry, this might be out of topic; but in this rule you have blocked all icmp packets coming in, this could lead to a blackhole situation, which is not good.

This has been described in rfc2923.
 
  


Reply

Tags
apache, forwarding, iptables, nat, server


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables not port forwarding blackfish Linux - Networking 6 08-18-2010 11:21 AM
iptables port forwarding packets Linux - Networking 14 06-10-2010 09:45 AM
Iptables - port forwarding to blocked port? spangberg Linux - Networking 2 03-26-2010 04:48 AM
IPCHAINS port forwarding and IPTABLES port forwarding ediestajr Linux - Networking 26 01-14-2007 07:35 PM
Iptables -- Port Forwarding slack_baby Linux - Networking 3 06-03-2004 02:29 PM


All times are GMT -5. The time now is 10:12 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration