LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)
-   -   Nat Prerouting (https://www.linuxquestions.org/questions/linux-networking-3/nat-prerouting-101381/)

lambmt 10-07-2003 06:04 PM
Nat Prerouting
 
I want to host a webserver and ftp server within my network but only have 1 REAL ipaddress i want to prerout to them but i encountered a problem with the FTP part when prerouting the interface i could not connect to ftp outside of my network and ideas on howto prerout only incoming connections on a certain ipaddress?

thanks

ToniT 10-07-2003 06:39 PM
A sample code that forwards connections made to your nat-computers' ftp-port from the interface IF_INET to the ip 192.168.1.11.
Code:
IF_INET="your internet interface, like eth0"
iptables --table nat --append PREROUTING --in-interface $IF_INET -p tcp --destination-port ftp --jump DNAT --to-destination 192.168.1.11:ftp
iptables --append FORWARD -p tcp --destination 192.168.1.11 --destination-port ftp --jump ACCEPT
This should work atleast on passive ftp mode.

ToniT 10-07-2003 06:44 PM
And the other question about limiting the scope of the rule to certain ip addresses (not only by interface as done above): "--source" does the job.

Something like
Code:
iptables --append FORWARD --source evil.bastard.somewhere.inter.net --jump DROP
makes the packets sourced from evil.bastard.somewhere.inter.net to be not forwarded but thrown away. (remember the correct ordering of the rules)

lambmt 10-07-2003 07:13 PM
what about HTTP?

same thing just replace ftp with http or port 80? 8080?

ToniT 10-07-2003 07:18 PM
That's correct. You can use service names (found in /etc/services) or raw port numbers in the iptables port matching patterns.

lambmt 10-07-2003 08:17 PM
ok when i goto the ip of the NAT in the broser it still goes to the web pages set up on the NAT... i set them up there to see what page would load...when i goto the ip of the web server the corect page is shown....

from inside the nat on the 192.168 network i cannot goto the ip of the NAT it times out.... which.... "i think" is becuase its prerouting something somewhere else i will try flushing nat and and going to the addr with out prerouting to see if it times out....


All times are GMT -5. The time now is 01:12 AM.