Go Job Hunting at the LQ Job Marketplace
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 10-31-2004, 03:33 PM   #1
Registered: Sep 2004
Distribution: Fedora Core 3
Posts: 47

Rep: Reputation: 15
Routing with iptables

Hi everybody.
I have 2 PC's, one with Windows and one with Linux Fedora Core 2.
The Linux has two ethernet cards, one is connected to a ADSL modem(adress of this card is, let's say and the other one is connected to my windows PC (
The windows PC is The Linux machine is there as a router/firewall. Browsing is OK, I can acces the internet from both the Linux and the Windows PC.
Here's the problem:
my modem is set up with a DMZ, so it forwards all inbound traffic to When someone wants to create a new connection to my Linux, everything is OK, users are able to connect (ofcourse, after apropriate settings are made in the INPUT chain), but when someone wants to connect (create a new connection) to my windows PC, it isn't possible (as the modem forwards all traffic to So I thought: I'll use the Linux firewall to route. I typed:
"iptables -t nat -A PREROUTING -s <some-ip> -p tcp --dport <some-port> -j DNAT --to-destination"
This should forward all inbound traffic from an internet IP destined to a specific port to my Windows PC directly.
The problem is that it doesn't. I checked the counters and it seems to me that not all incoming packets come trough this chain and none packets are matched with the rule I speciefied. Is the PREROUTING chain behind the Input chain and do I need to approve the new connection as INPUT also (now, it would not pass the INPUT chain)? Or am I doing wrong something else?
Thank you
Old 10-31-2004, 05:23 PM   #2
Registered: Jan 2004
Location: Gießen, Germany
Distribution: Xubuntu 12.04, Mythbuntu, Ubuntu Server 12.04
Posts: 174

Rep: Reputation: 24
The PREROUTING chain of the nat table is the first to be checked, see the diagram on

However, after the routing decision, the packet will run through either INPUT, OUTPUT or FORWARD chain of the filter table. In your case, it will be FORWARD. For each DNAT line in nat/PREROUTING you should have a corresponding line in filter/FORWARD, like:

"iptables -A FORWARD -s <some-ip> -p tcp -d --dport <some-port> -j ACCEPT"

Old 11-01-2004, 02:35 AM   #3
Registered: Sep 2004
Distribution: Fedora Core 3
Posts: 47

Original Poster
Rep: Reputation: 15

According to your explanation, if the <some-ip> tryes to send data to <some-port> and those finish on, the firewall should match this packet and change it, right? Regardless of the setting in the FORWARD chain, if the counter in the PREROUTING chain says that it hasn't matched any connection(and <some-ip> tryed a few times), than none packes were changed? Or do the counters in the PREROUTING work different?
Never the less, I'll try again, and post the result.
Old 11-01-2004, 06:56 AM   #4
Registered: Sep 2004
Distribution: Fedora Core 3
Posts: 47

Original Poster
Rep: Reputation: 15

No, it didn't help.
I did "iptables -A FORWARD -s <some-ip> -p tcp --dport <some-port> -j ACCEPT". I zeroed the counters, and the result is the same. Nither one of the rules in the PREROUTING chain and in the FORWARD chain have been matched. I don't understand why.
1. when a packet starting a connection comes in, the PREROUTING chain is consulted first, then come the INPUT/FORWARD chains depending on the destination, right?
2. are there any other things that need to be set up apart from iptables?
Please help me, I'm desperate here.
Old 11-01-2004, 07:21 AM   #5
Senior Member
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
try "-I" instaed of "-A"
like this:
iptables -I FORWARD -s <some-ip> -p tcp --dport <some-port> -j ACCEPT
iptables -t nat -I PREROUTING -s <some-ip> -p tcp --dport <some-port> -j DNAT --to-destination

good luck.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
routing by iptables ali_dd15 Linux - Networking 14 10-14-2005 06:38 AM
iptables routing CJ_Grobler Linux - Security 1 06-14-2005 03:13 AM
iptables and routing palhope Linux - Networking 2 07-10-2003 01:01 PM
iptables / routing hakcenter Linux - Networking 13 05-01-2003 05:16 AM
routing with iptables Han_Solo Linux - Security 0 10-28-2001 07:04 PM

All times are GMT -5. The time now is 12:19 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration