LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 10-31-2004, 02:33 PM   #1
logo
Member
 
Registered: Sep 2004
Distribution: Fedora Core 3
Posts: 47

Rep: Reputation: 15
Routing with iptables


Hi everybody.
I have 2 PC's, one with Windows and one with Linux Fedora Core 2.
The Linux has two ethernet cards, one is connected to a ADSL modem(adress of this card is, let's say 10.1.1.1) and the other one is connected to my windows PC (10.1.0.1).
The windows PC is 10.1.0.2. The Linux machine is there as a router/firewall. Browsing is OK, I can acces the internet from both the Linux and the Windows PC.
Here's the problem:
my modem is set up with a DMZ, so it forwards all inbound traffic to 10.1.1.1(Linux). When someone wants to create a new connection to my Linux, everything is OK, users are able to connect (ofcourse, after apropriate settings are made in the INPUT chain), but when someone wants to connect (create a new connection) to my windows PC, it isn't possible (as the modem forwards all traffic to 10.1.1.1). So I thought: I'll use the Linux firewall to route. I typed:
"iptables -t nat -A PREROUTING -s <some-ip> -p tcp --dport <some-port> -j DNAT --to-destination 10.1.0.2"
This should forward all inbound traffic from an internet IP destined to a specific port to my Windows PC directly.
The problem is that it doesn't. I checked the counters and it seems to me that not all incoming packets come trough this chain and none packets are matched with the rule I speciefied. Is the PREROUTING chain behind the Input chain and do I need to approve the new connection as INPUT also (now, it would not pass the INPUT chain)? Or am I doing wrong something else?
Thank you
 
Old 10-31-2004, 04:23 PM   #2
ricstirato
Member
 
Registered: Jan 2004
Location: Gießen, Germany
Distribution: Xubuntu 12.04, Mythbuntu, Ubuntu Server 12.04
Posts: 174

Rep: Reputation: 24
The PREROUTING chain of the nat table is the first to be checked, see the diagram on
http://www.linuxguruz.com/iptables/h...s-HOWTO-5.html

However, after the routing decision, the packet will run through either INPUT, OUTPUT or FORWARD chain of the filter table. In your case, it will be FORWARD. For each DNAT line in nat/PREROUTING you should have a corresponding line in filter/FORWARD, like:

"iptables -A FORWARD -s <some-ip> -p tcp -d 10.1.0.2 --dport <some-port> -j ACCEPT"

Regards
ric.
 
Old 11-01-2004, 01:35 AM   #3
logo
Member
 
Registered: Sep 2004
Distribution: Fedora Core 3
Posts: 47

Original Poster
Rep: Reputation: 15
Weird

According to your explanation, if the <some-ip> tryes to send data to <some-port> and those finish on 10.1.1.1, the firewall should match this packet and change it, right? Regardless of the setting in the FORWARD chain, if the counter in the PREROUTING chain says that it hasn't matched any connection(and <some-ip> tryed a few times), than none packes were changed? Or do the counters in the PREROUTING work different?
Never the less, I'll try again, and post the result.
Thanks
 
Old 11-01-2004, 05:56 AM   #4
logo
Member
 
Registered: Sep 2004
Distribution: Fedora Core 3
Posts: 47

Original Poster
Rep: Reputation: 15
Result

No, it didn't help.
I did "iptables -A FORWARD -s <some-ip> -p tcp --dport <some-port> -j ACCEPT". I zeroed the counters, and the result is the same. Nither one of the rules in the PREROUTING chain and in the FORWARD chain have been matched. I don't understand why.
1. when a packet starting a connection comes in, the PREROUTING chain is consulted first, then come the INPUT/FORWARD chains depending on the destination, right?
2. are there any other things that need to be set up apart from iptables?
Please help me, I'm desperate here.
 
Old 11-01-2004, 06:21 AM   #5
maxut
Senior Member
 
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
try "-I" instaed of "-A"
like this:
iptables -I FORWARD -s <some-ip> -p tcp --dport <some-port> -j ACCEPT
iptables -t nat -I PREROUTING -s <some-ip> -p tcp --dport <some-port> -j DNAT --to-destination 10.1.0.2

good luck.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
routing by iptables ali_dd15 Linux - Networking 14 10-14-2005 05:38 AM
iptables routing CJ_Grobler Linux - Security 1 06-14-2005 02:13 AM
iptables and routing palhope Linux - Networking 2 07-10-2003 12:01 PM
iptables / routing hakcenter Linux - Networking 13 05-01-2003 04:16 AM
routing with iptables Han_Solo Linux - Security 0 10-28-2001 06:04 PM


All times are GMT -5. The time now is 06:53 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration