I have a rather complex iptables script that has been working wonderfully for, well, years.

I recently rebooted the server, everything came back up as expected, but something strange is happening now.

I have my port forwarding set up for various services (smtp, pop, etc.) and the rules work fine - however, it's acting as if the gateway is proxying inbound connections to these services. Meaning, it appears as though the firewall is actually connecting to the services, rather than relaying a connection from the outside world.

So, in all of my logs, I have the IP address of the firewall and not the actual connecting client and I'm not sure where this is getting messed up.

Here's an example rule:

iptables -t nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 25 -j DNAT --to 10.x.x.x:25 -m comment --comment "SMTP"

Thoughts?

Thanks!

Hi,

IMHO this is exactly the way a proxy is supposed to work. Isn't it?
It isolates the internal IPs from the outside and vice-versa.
I am really interested to what you had before rebooting the server.

Regards,

Tshimanga.

Yes, it's acting exactly like a proxy, but that's not how port forwarding with iptables is supposed to work.

When you port forward, the machine/device doing the routing doesn't manipulate the source address.. so the original source address isn't modified when it reaches the destination.

From what I know
-j MASQUERADE
and
-j DNAT
do IP proxying/NATing.