port forwarding NOT working :(

Avatar · 04-22-2004, 11:19 AM

maxut:

sorry... 192.168.1.183 is me (my computer where I'm testing the connection with a browser). I changed my post, because I realised I copied the two wrong lines. hehehe

eth1 is connected to the LAN switch and eth0/ppp0 is connected to the ADSL modem.

zoidac: I'll try that and post the results.

Avatar · 04-22-2004, 11:41 AM

Hmm strange things...

I did the port scan on port 5523, and then tried a scan of a random port (2372) and the results were the same:

-----------------
Probing Your Port 5523

The GRC server is attempting to establish a TCP connection to Port 5523 of your computer located at Internet at IP address 64.231.X.X:

Total elapsed testing time: 5.002 seconds

Port Status Protocol and Application
5523 Stealth Unknown Protocol for this port
Unknown Application for this port
------------------

hmmm... i checked my /var/log/messages again and found THIS!
(note: eth1 is the LAN,
204.1.226.X is the port scanning site,
192.168.1.121 is the internal computer I'm trying to connect to via port 5523,
192.168.1.183 is the computer I tested the port scanner from)

Code:

Apr 22 12:35:31 localhost kernel: dropped IN=ppp0 OUT=eth1 SRC=204.1.226.228 DST=192.168.1.121 LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=32768 PROTO=TCP SPT=49283 DPT=80 WINDOW=8192 RES=0x00 SYN URGP=0
Apr 22 12:35:31 localhost kernel: IN=ppp0 OUT=eth1 SRC=204.1.226.226 DST=192.168.1.183 LEN=120 TOS=0x00 PREC=0x00 TTL=111 ID=30035 DF PROTO=TCP SPT=443 DPT=1366 WINDOW=64706 RES=0x00 ACK PSH URGP=0
Apr 22 12:35:31 localhost kernel: IN=eth1 OUT=ppp0 SRC=192.168.1.183 DST=204.1.226.226 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=15524 DF PROTO=TCP SPT=1366 DPT=443 WINDOW=16624 RES=0x00 ACK URGP=0
Apr 22 12:35:32 localhost kernel: dropped IN=ppp0 OUT=eth1 SRC=204.1.226.228 DST=192.168.1.121 LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=32768 PROTO=TCP SPT=49283 DPT=80 WINDOW=8192 RES=0x00 SYN URGP=0
Apr 22 12:35:32 localhost kernel: IN=ppp0 OUT=eth1 SRC=204.1.226.226 DST=192.168.1.183 LEN=120 TOS=0x00 PREC=0x00 TTL=111 ID=30074 DF PROTO=TCP SPT=443 DPT=1366 WINDOW=64706 RES=0x00 ACK PSH URGP=0
Apr 22 12:35:32 localhost kernel: IN=eth1 OUT=ppp0 SRC=192.168.1.183 DST=204.1.226.226 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=15525 DF PROTO=TCP SPT=1366 DPT=443 WINDOW=16544 RES=0x00 ACK URGP=0
Apr 22 12:35:32 localhost kernel: IN=ppp0 OUT=eth1 SRC=204.1.226.226 DST=192.168.1.183 LEN=120 TOS=0x00 PREC=0x00 TTL=111 ID=30257 DF PROTO=TCP SPT=443 DPT=1366 WINDOW=64706 RES=0x00 ACK PSH URGP=0
Apr 22 12:35:32 localhost kernel: dropped IN=ppp0 OUT=eth1 SRC=204.1.226.228 DST=192.168.1.121 LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=32768 PROTO=TCP SPT=49283 DPT=80 WINDOW=8192 RES=0x00 SYN URGP=0
Apr 22 12:35:32 localhost kernel: IN=eth1 OUT=ppp0 SRC=192.168.1.183 DST=204.1.226.226 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=15526 DF PROTO=TCP SPT=1366 DPT=443 WINDOW=16464 RES=0x00 ACK URGP=0

Argh!!! It's receiving my packets and knows where to send them, but it's DROPPING them!!!! Why!?!?

Edit: and I found this little jewel in my /var/log/messages (only once)
Apr 22 12:39:17 localhost kernel: host 192.168.1.183/if3 ignores redirects for 192.168.1.121 to 192.168.1.121.

Technoslave · 04-22-2004, 01:49 PM

Heh, woo port forwarding.

As can be found on my own peronsal reminder page. This is how you do port forwarding in two easy steps:

/sbin/iptables -t nat -I PREROUTING -p tcp -d 209.190.200.143 --dport 81 -j DNAT --to 10.0.0.2:80
/sbin/iptables -I FORWARD -p tcp -d 10.0.0.2 --dport 80 -j ACCEPT

Basically, it's taking port 81 on my regular box, and forwarding it to port 80 on my internal private box.

Avatar · 04-22-2004, 02:38 PM

Thank you technoslave, I added those two lines and now it works!! Both from my internal and external machines!!! Note: it does NOT work for me without the POSTROUTING command.

Here's the full working forwarding code in case anyones needs it.

Code:

# Port forward port number 5523 to the databaseserver at 192.168.1.121
echo -e "  Loading PORT forwarding"

# forward any external (eth0/ppp0) and internal (eth1) requests for port 5523 and destination machine
iptables -A FORWARD -i eth0 -p tcp --dport 5523 -j pass-and-log
iptables -A FORWARD -i ppp0 -p tcp --dport 5523 -j pass-and-log
iptables -A FORWARD -i eth1 -p tcp --dport 5523 -j pass-and-log
iptables -I FORWARD -p tcp -d 192.168.1.121 --dport 80 -j pass-and-log

# Prerouting for external and internal requests for port 5523
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 5523 -j DNAT --to 192.168.1.121:80
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 5523 -j DNAT --to 192.168.1.121:80
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 5523 -j DNAT --to 192.168.1.121:80
iptables -t nat -I PREROUTING -p tcp -d 64.231.85.11 --dport 5523 -j DNAT --to 192.168.1.121:80

# Postrouting
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to 64.231.85.11

maxut · 04-23-2004, 01:53 AM

i think i will need this port forward rules in the future too.
thnx to all