Visit Jeremy's Blog.
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 11-02-2012, 07:15 AM   #1
LQ Newbie
Registered: Nov 2012
Posts: 2

Rep: Reputation: Disabled
IPTables Port forwarding rules does not work in internal network


I have the following iptables rules on proxy host, which forwards traffic to Server:
iptables -t nat -A PREROUTING -d $host_ip -i eth0 -p tcp -m tcp --dport $host_port -j DNAT --to-destination $server_ip:$server_port
iptables -t nat -A POSTROUTING -p tcp --dport $server_port -d $server_ip -j SNAT --to $host_ip

For one server(call it A), when i try to connect with echo client using proxy host_ip:host_port it works fine and client is connecting to server A, server_ip:server_port.

For other server(call it B), when i try to connect with echo client using proxy host_ip:host_port it does not work and there is a strange behavior.
Connection success rate of echo client is about 1%. About 100 attempts, one is successful. Period of successful attempts is not regular, it can be successful 1 of 300, or 3 of 100.
• Tcpdump logs were collected on proxy host and server. The analysis of these logs showed that the proxy server forwards traffic to server, server sends a response, but proxy server does not receive it (i.e. it is visible in the server dump that the response is sent to proxy, but there’s no corresponding packet in the proxy dump).
• An unexplained correlation was found: when an attempt is done to connect other client to the same echo-server (simultaneously with running echo-client), responses from the echo-server are received successfully by the echo-client.

What can be root cause of this issue? Should we find the problems on server B or on proxy server? Please, help.

Last edited by BushNik; 11-06-2012 at 12:20 AM.
Old 11-06-2012, 12:16 AM   #2
LQ Newbie
Registered: Nov 2012
Posts: 2

Original Poster
Rep: Reputation: Disabled
The issue is that iptables port forwarding rules works only for external connections and not for connections in internal network. It's called nat loopback. I have tried to set these rules:
* iptables -t nat -A PREROUTING -d $host_ip -i eth0 -p tcp -m tcp --dport $host_port -j DNAT --to-destination $server_ip:$server_port
* iptables -t nat -A POSTROUTING -s $source_ip -p tcp --dport $server_port -d $server_ip -j SNAT --to $host_ip

Postrouting rules will applies only for one machine, but it does not help to solve the issue, client connection from $source_ip is always freezes at the same place.

Last edited by BushNik; 11-06-2012 at 03:49 AM.
Old 11-19-2012, 04:37 PM   #3
Registered: May 2006
Location: Bayern, Germany
Distribution: Many
Posts: 224

Rep: Reputation: 41
If you are using the POSTROUTING rule for the "return" packets you should do it this way (assuming $host_ip is configured as gw of $server_ip):
iptables -t nat -A POSTROUTING -s $server_ip -p tcp --sport $server_port -j SNAT --to-source $host_ip


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables rules to limit nat forwarding sleepylight Linux - Security 1 07-19-2012 06:06 PM
Ban many hosts - IPTables with many rules (>20'000) njam Linux - Security 5 07-24-2009 06:29 AM
IPCHAINS port forwarding and IPTABLES port forwarding ediestajr Linux - Networking 26 01-14-2007 07:35 PM
Need basic routing rules + a little port forwarding. Pcghost Linux - Networking 1 03-08-2003 11:21 PM
IpTables port forwarding works but cant get out acdcbag Linux - Networking 1 11-08-2001 03:48 PM

All times are GMT -5. The time now is 12:38 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration