LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)
-   -   Iptables problems with port forwarding (https://www.linuxquestions.org/questions/linux-networking-3/iptables-problems-with-port-forwarding-350074/)

jebaird 08-04-2005 07:25 PM
Iptables problems with port forwarding
 
I am trying to get portforwarding to work on my linux router. I would like to host a webserver that listens on 8080.
eth1 is my internet interface
eth0 is my LAN interface

I got NAT to work this scricpt:

modprobe iptable_nat
echo 1> /proc/sys/net/ipv4/ip_forward

iptables -A POSTROUTING -t nat -o eth1 -s 10.0.0.0/24 -d 0/0 -j MASQERADE
iptables - FORWARD -t filter -o eth1 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -t filter -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

as for the Port forwarding this is what I have so far:
Iptables -t nat - A POSTROUTING -p tcp -i eth1 -d 161.210.34.156 ---dport 80 ---sport 1024:65535 -j DNAT --to 10.0.0.11:8080

iptables -p tccp -i eth1 -eth0 -d 10.0.0.11 --dport 8080 --sport 1024:65535 -m state --state NEW -j ACCEPT

iptables -A FORWARD -t filter -o eth1 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -t filter -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

I am very new with iptables. any tips would be great!!
thanks

win32sux 08-04-2005 11:40 PM
Re: Iptables problems with port forwarding
 
Quote:
Originally posted by jebaird
I am trying to get portforwarding to work on my linux router. I would like to host a webserver that listens on 8080.
eth1 is my internet interface
eth0 is my LAN interface

I got NAT to work this scricpt:

modprobe iptable_nat
echo 1> /proc/sys/net/ipv4/ip_forward

iptables -A POSTROUTING -t nat -o eth1 -s 10.0.0.0/24 -d 0/0 -j MASQERADE
iptables - FORWARD -t filter -o eth1 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -t filter -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

as for the Port forwarding this is what I have so far:
Iptables -t nat - A POSTROUTING -p tcp -i eth1 -d 161.210.34.156 ---dport 80 ---sport 1024:65535 -j DNAT --to 10.0.0.11:8080

iptables -p tccp -i eth1 -eth0 -d 10.0.0.11 --dport 8080 --sport 1024:65535 -m state --state NEW -j ACCEPT

iptables -A FORWARD -t filter -o eth1 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -t filter -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

I am very new with iptables. any tips would be great!!
thanks
try this instead (it's basically the same but i cleaned it up for you a little bit ;) ):

Code:
echo 0 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

iptables -F
iptables -F -t nat
iptables -F -t mangle
iptables -X
iptables -X -t nat
iptables -X -t mangle

iptables -P FORWARD DROP

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i eth0 -o eth1 -s 10.0.0.0/24 \
-m state --state NEW -j ACCEPT

iptables -A FORWARD -p TCP -i eth1 -eth0 -d 10.0.0.11 --dport 8080 \
-m state --state NEW -j ACCEPT

iptables -t nat -A PREROUTING -p TCP -i eth1 -d 161.210.34.156 \
--dport 80 -j DNAT --to-destination 10.0.0.11:8080

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward
just my :twocents:...

jebaird 08-05-2005 11:28 AM
thanks win32sux,
I like the cleaned up code, it makes more sence

win32sux 08-05-2005 12:35 PM
Quote:
Originally posted by jebaird
thanks win32sux,
I like the cleaned up code, it makes more sence
your welcome... :)

BTW, since you have a static IP, you might wanna use SNAT instead of MASQUERADE:
Code:
EXT_IP="161.210.34.156"

echo 0 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

iptables -F
iptables -F -t nat
iptables -F -t mangle
iptables -X
iptables -X -t nat
iptables -X -t mangle

iptables -P FORWARD DROP

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i eth0 -o eth1 -s 10.0.0.0/24 \
-m state --state NEW -j ACCEPT

iptables -A FORWARD -p TCP -i eth1 -eth0 -d 10.0.0.11 --dport 8080 \
-m state --state NEW -j ACCEPT

iptables -t nat -A PREROUTING -p TCP -i eth1 -d $EXT_IP --dport 80 \
-j DNAT --to-destination 10.0.0.11:8080

iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source $EXT_IP

echo 1 > /proc/sys/net/ipv4/ip_forward


All times are GMT -5. The time now is 05:23 AM.