port forward

ezalpar · 11-26-2009, 03:58 AM

Hi

I have a port forward using iptables (tcp/443) and it's OK. But I can't access any web site that using https. I set my port forwarding with this commands:
iptables -A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.60.2
iptables -A FORWARD -p tcp -m tcp -d 192.168.60.2 --dport 443 -m state --state NEW -j ACCEPT

thanks in advance for any help

Web31337 · 11-26-2009, 05:00 AM

you can't access it from WEB or from LOCAL network?

ezalpar · 11-26-2009, 05:50 AM

I can't access https from LOCALNET

Web31337 · 11-26-2009, 07:23 AM

Found on google: http://serverfault.com/questions/741...ip-nat-problem
I either suggest add your hostnames to /etc/hosts as 127.0.0.1 (or your gray IP on the localnet, 192.168.60.2) or setup a DNS server on router and add your domain there and also point it to local IP of your serv so it will be available on all localnet without hacks around /etc/hosts.
i use both methods here. i have server behind NAT(i am NOW behind the NAT with several sites available from internet) and i run recursive DNS on my router(and also it has my domain's records).

nimnull22 · 11-26-2009, 01:57 PM

Quote:

Originally Posted by ezalpar

Hi

I have a port forward using iptables (tcp/443) and it's OK. But I can't access any web site that using https.

What is OK then?

Quote:

Originally Posted by ezalpar

I set my port forwarding with this commands:
iptables -A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.60.2
iptables -A FORWARD -p tcp -m tcp -d 192.168.60.2 --dport 443 -m state --state NEW -j ACCEPT

I think you have to check manual for iptable rules.

Web31337 · 11-26-2009, 11:09 PM

sorry. misread. but note that info also, if you'll experience that troubles.

this is my config that works: i had same trouble, i could not access ports i forward myself on the net.

Code:

# HTTP:HTTPS
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 443 -j DNAT --to 192.168.60.2
iptables -A FORWARD -p tcp -i ppp0 -d 192.168.60.2 --dport 443 -j ACCEPT

my router is connected with PPTP so ppp0 is my interface with white IP, i guess you'll need eth0 if it's on the net. with this config i am able to contact any computer on the net on port 443.

ezalpar · 11-27-2009, 04:32 AM

problem solved with adding -i eth1 (eth1 my external card) to my rule

thnaks for the answers