Linux - NetworkingThis forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Introduction to Linux - A Hands on Guide
This guide was created as an overview of the Linux Operating System, geared toward new users as an exploration tour and getting started guide, with exercises at the end of each chapter.
For more advanced trainees it can be a desktop reference, and a collection of the base knowledge needed to proceed with system and network administration. This book contains many real life examples derived from the author's experience as a Linux system and network administrator, trainer and consultant. They hope these examples will help you to get a better understanding of the Linux system and that you feel encouraged to try out things on your own.
Click Here to receive this Complete Guide absolutely free.
I have 2 PC's, one with Windows and one with Linux Fedora Core 2.
The Linux has two ethernet cards, one is connected to a ADSL modem(adress of this card is, let's say 10.1.1.1) and the other one is connected to my windows PC (10.1.0.1).
The windows PC is 10.1.0.2. The Linux machine is there as a router/firewall. Browsing is OK, I can acces the internet from both the Linux and the Windows PC.
Here's the problem:
my modem is set up with a DMZ, so it forwards all inbound traffic to 10.1.1.1(Linux). When someone wants to create a new connection to my Linux, everything is OK, users are able to connect (ofcourse, after apropriate settings are made in the INPUT chain), but when someone wants to connect (create a new connection) to my windows PC, it isn't possible (as the modem forwards all traffic to 10.1.1.1). So I thought: I'll use the Linux firewall to route. I typed:
"iptables -t nat -A PREROUTING -s <some-ip> -p tcp --dport <some-port> -j DNAT --to-destination 10.1.0.2"
This should forward all inbound traffic from an internet IP destined to a specific port to my Windows PC directly.
The problem is that it doesn't. I checked the counters and it seems to me that not all incoming packets come trough this chain and none packets are matched with the rule I speciefied. Is the PREROUTING chain behind the Input chain and do I need to approve the new connection as INPUT also (now, it would not pass the INPUT chain)? Or am I doing wrong something else?
However, after the routing decision, the packet will run through either INPUT, OUTPUT or FORWARD chain of the filter table. In your case, it will be FORWARD. For each DNAT line in nat/PREROUTING you should have a corresponding line in filter/FORWARD, like:
According to your explanation, if the <some-ip> tryes to send data to <some-port> and those finish on 10.1.1.1, the firewall should match this packet and change it, right? Regardless of the setting in the FORWARD chain, if the counter in the PREROUTING chain says that it hasn't matched any connection(and <some-ip> tryed a few times), than none packes were changed? Or do the counters in the PREROUTING work different?
Never the less, I'll try again, and post the result.
No, it didn't help.
I did "iptables -A FORWARD -s <some-ip> -p tcp --dport <some-port> -j ACCEPT". I zeroed the counters, and the result is the same. Nither one of the rules in the PREROUTING chain and in the FORWARD chain have been matched. I don't understand why.
1. when a packet starting a connection comes in, the PREROUTING chain is consulted first, then come the INPUT/FORWARD chains depending on the destination, right?
2. are there any other things that need to be set up apart from iptables?
Please help me, I'm desperate here.