LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 12-23-2002, 04:16 PM   #1
ivanros
LQ Newbie
 
Registered: Dec 2002
Posts: 2

Rep: Reputation: 0
IPTABLES port forwarding to internal network


Hi,

I have an IP from a ISP and have an internal network 192.168.0.0. I use Red Hat Linux 7.2 and IPTABLES to share internet. The internal IP of the Linux machine is 192.168.0.1. I have an Windows FTP server on 192.168.0.2 and I want to use the Linux machine as a gateway between the Win FTP server en the internet. Thus I want the Win FTP server to be accessable form my IP provided by the ISP on port 7021.

My current rc.firewall file has the following relevant lines:

$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -t nat -F

echo " FWD: Allow all connections OUT and only existing and related ones IN"
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG

echo " Enabling SNAT (MASQUERADE) functionality on $EXTIF"
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE


After this file is executed I ran the following Lines, I also tried "ibtables -F" and the to run the following lines:
/sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 7021 -j DNAT --to 192.168.0.2:21
/sbin/iptables -A FORWARD -p tcp -i eth0 -d 192.168.0.2 --dport 21 -j ACCEPT


In stead of these two lines I also tried:
iptables -t nat -A PREROUTING -p tcp -d 131.155.226.204 --dport 7021 -j DNAT --to 192.168.0.2:21

But the port doesn't open, thus I cannot make a connection from the internet to my Win FTP server on the internal network. When I try to telnet the server with comando: telnet external_ip 7021 I get the message "Trying external ip... telnet: connect to address external_ip: Connection refused" And when I use the commando nmap -p 7021 external_ip I see the port is closed.

I hope someone can help me out.

Thanks in advance,

Ivan Rosaria
 
Old 12-26-2002, 06:29 PM   #2
Miky
Member
 
Registered: Dec 2002
Location: London / Paris
Distribution: Debian (optionally Free/OpenBsd)
Posts: 72

Rep: Reputation: 15
You should definately read some (a lot actually) netfilter (iptables) documentation.

iptables does NOT work exactly like ipchains

First mistake (not with your pb but with security)

-----------------------------------
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
-----------------------------------
Your defaulft policy should be drop
Input and output are related to the machine
forward to the subnet behind it



-------------------------------------
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
-------------------------------------
I don't remember exactly this point but iptables here doesn't look at the syn flag to use the stateful mode, it looks at a table it wrote.

1. You can use the syn or !syn option as in ipchains

2. or you use the stateful mode
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -m state --state NEW,ESTABLISHED -j ACCEPT

Hope you see what i added in the second rule

Now your telnet will work but not your ftp (because you're probably trying to use another interface for it), see documentation for more precision (actually you have to write more rules)


Ciao
 
Old 12-28-2002, 10:19 PM   #3
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 47
Did you 'echo 1 > /proc/sys/net/ipv4/ip_forward' ?

And you may find this tutorial good reading.

Last edited by peter_robb; 12-28-2002 at 10:21 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
IPCHAINS port forwarding and IPTABLES port forwarding ediestajr Linux - Networking 26 01-14-2007 07:35 PM
External port forwarding to an internal host antken Linux - Networking 3 12-17-2006 09:43 AM
iptables forwarding to internal server pyloth Linux - Security 4 04-17-2005 12:51 PM
Port Forwarding not working for Internal requests angelgw Linux - Networking 2 06-29-2003 12:42 AM
Port forwarding to internal machine zamzara Linux - Networking 8 12-01-2002 12:21 AM


All times are GMT -5. The time now is 03:37 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration