| CommanderKang |
08-26-2010 09:31 PM |
IPTables Static NAT, 2 networks, unable to forward packets to Port 80
Greetings all I hope I can find some direction with my iptables setup. I've been working from the following guide Linux Firewalls using iptables in an attempt to setup a static route for my two internal networks. One network is a private home network and the other network has a test instance of IIS6 running on it.
The home network can currently connect to the internet without any issue and so can any servers on the second network. What I can't seem to get to work is this line...
Code:
iptables -A FORWARD -p tcp -i eth0 -o eth2 -d 192.168.2.2 -m multiport --dports 80,443 -m state --state NEW -j ACCEPT
I'm not sure what I'm missing but nothing that attempts to establish a connection to the external address for the web server can get in on port 80. I've tried various log settings in an attempt to nail down the issue but I'm stumped. Below I'm posting my current iptables config in the hopes some one will spot something obvious.
Code:
#/bin/bash
iptables -F
iptables -t nat -F
iptables -t mangle -F
#To Web server -d 173.10.132.250
iptables -t nat -A PREROUTING -d 173.10.132.250 -i eth0 -j DNAT --to-destination 192.168.2.2
#From Web server
#iptables -A POSTROUTING -s 192.168.2.2 -j LOG --log-prefix "POSTROUTING ETH0 " --log-level 7
iptables -t nat -A POSTROUTING -s 192.168.2.2 -o eth0 -j SNAT --to-source 173.10.132.250
# From home network
#iptables -A POSTROUTING -s 192.168.1.1/24 -j LOG --log-prefix "POSTROUTING ETH0 HOME " --log-level 7
iptables -t nat -A POSTROUTING -s 192.168.1.1/24 -j SNAT -o eth0 --to-source 173.10.132.249
#Forward traffic to web server
iptables -A FORWARD -p tcp -i eth0 -o eth2 -d 192.168.2.2 -m multiport --dports 80,443 -m state --state NEW -j ACCEPT
#Allow and maintain all outbound connections from home network
iptables -A FORWARD -t filter -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#Allow and maintain allow established inbound connections to home network
iptables -A FORWARD -t filter -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -d 173.10.132.249/29 --dport 22 -j REJECT
#iptables -A FORWARD -d 192.168.2.2 -j LOG --log-prefix "FORWARD " --log-level 7
#iptables -t nat -A PREROUTING -d 173.10.132.250 -i eth0 -j LOG --log-prefix "PREROUTE " --log-level 7
#iptables -A FORWARD -p tcp -i eth0 -o eth2 -d 192.168.2.2 -j LOG --log-prefix "PREROUTE " --log-level 7
iptables -A INPUT -p tcp -d 192.168.2.2/32 --dport 80 -j LOG --log-prefix "PREROUTE " --log-level 7
service iptables save
service iptables restart
Code:
173.10.132.249
173.10.132.250--------ETH0--|
|---ETH1--- 192.168.1.x/32 (Home computers)
|
|---ETH2--- 192.168.2.x/32 (Web Server listening on Port 80 and 443)
|
