LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 11-20-2008, 11:55 AM   #1
ajayan
Member
 
Registered: Dec 2007
Posts: 89

Rep: Reputation: 16
Nating+webserver


Dear All
I have configured a gateway machine in linux (Centos5) which has three lan cards eth0,eth1,eth2.eth1 and eth2 holds two static IPs where eth0 holds local ip which is 10.10.10.252.now i want to redirect all web request to these static ips to an internal web server(10.10.10.75) running in IIS.i have written some rules.Now the internet is accessable to internal network through this gateway.But redirection doesnot occures.when i try from internet to these static ips i can't get webpages.Just "Connection time out".Here is my rules.I have already turned ipforwading in /etc/sysctl.conf
#iptables -t nat -A POSTROUTING -o eth2 -s 10.10.10.0/24 -j MASQUERADE
#iptables -t nat -A POSTROUTING -o eth1 -s 10.10.10.0/24 -j MASQUERADE
#iptables -t nat -A PREROUTING -d <staticIp1> -p tcp --dport 80 -j DNAT --to-destination 10.10.10.75:80
#iptables -t nat -A POSTROUTING -s 10.10.10.75 -j SNAT --to-source <staticip1>
#iptables -t nat -A OUTPUT -p tcp --dst <staticIP1> --dport 80 -j DNAT --to-destination 10.10.10.75:80
#iptables -t nat -A PREROUTING -d <staticIp2> -p tcp --dport 80 -j DNAT --to-destination 10.10.10.75:80
#iptables -t nat -A POSTROUTING -s 10.10.10.75 -j SNAT --to-source <staticip2>
#iptables -t nat -A OUTPUT -p tcp --dst <staticIP2> --dport 80 -j DNAT --to-destination 10.10.10.75:80
What is the problem Advance Thanks

Last edited by ajayan; 11-20-2008 at 11:59 AM.
 
Old 11-27-2008, 12:05 AM   #2
rnturn
Senior Member
 
Registered: Jan 2003
Location: Illinois (Chicago area)
Distribution: Red Hat (8.0, RHEL5,6), CentOS, SuSE (10.x, 11.x, 12.2, 13.2), Solaris (8-10), Tru64, MacOS, Raspian
Posts: 1,108

Rep: Reputation: 64
Quote:
Here is my rules.I have already turned ipforwading in /etc/sysctl.conf

.
.
.
#iptables -t nat -A POSTROUTING -o eth2 -s 10.10.10.0/24 -j MASQUERADE
#iptables -t nat -A POSTROUTING -o eth1 -s 10.10.10.0/24 -j MASQUERADE
#iptables -t nat -A PREROUTING -d <staticIp1> -p tcp --dport 80 -j DNAT --to-destination 10.10.10.75:80
#iptables -t nat -A POSTROUTING -s 10.10.10.75 -j SNAT --to-source <staticip1>
#iptables -t nat -A OUTPUT -p tcp --dst <staticIP1> --dport 80 -j DNAT --to-destination 10.10.10.75:80
#iptables -t nat -A PREROUTING -d <staticIp2> -p tcp --dport 80 -j DNAT --to-destination 10.10.10.75:80
#iptables -t nat -A POSTROUTING -s 10.10.10.75 -j SNAT --to-source <staticip2>
#iptables -t nat -A OUTPUT -p tcp --dst <staticIP2> --dport 80 -j DNAT --to-destination 10.10.10.75:80

.
.
.
Well, hopefully, that pound sign at the beginning of the line is supposed to indicate that you're issuing those commands while logged in as root. If not that could be your problem.

I have a similar set of commands for redirecting HTTP traffic to an internal web server. My hardware configuration is a little different. Instead of using multiple ethernet interfaces, I have multiple IPs aliases onto a single external interface (eth1). I don't think the difference is significant.

In my firewall setup, I use:
Code:
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
 .
 .
 .
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP
 .
 .
 .
iptables --append OUTPUT --protocol all --source 127.0.0.1 --jump ACCEPT
iptables --append OUTPUT --protocol all --source ${INTERNAL_IP} --jump ACCEPT
iptables --append OUTPUT --protocol all --source ${EXTERNAL_IP} --jump ACCEPT
 .
 .
 .
[ a whole bunch of filtering/logging commands ]
 .
 .
 .
iptables -t nat -F PREROUTING
iptables -t nat -F OUTPUT
iptables -t nat -F POSTROUTING
 .
 .
 .
iptables --table nat --append POSTROUTING --out-interface eth1 --jump SNAT --to-source ${EXTERNAL_IP}
 .
 .
 .
iptables --table nat --append PREROUTING --in-interface eth1 --destination ${EXTERNAL_IP}--source ${ANYONE} --protocol tcp --destination-port 80 --jump DNAT --to-destination ${WWW_IP}:80
where $EXTERNAL_IP is the IP address on the dirty side of the firewall, $ANYONE is "0/0", and $WWW_IP is the internal IP address (192.168.what.ever). I only showed one of the PREROUTING commands I have set up.

Now the only difference that I see -- other than my use of the long option names -- is what's specified in the "-s" or "--source" switches. And the way you've setup the OUTPUT. I also don't have any of the commands that include the MASQUERADE target. If you have static IP addresses (and you said you do), I think the MASQUERADE target can cause problems. See the iptables(8) manpage where the target extensions are discussed. I suspect you'll need to switch those to use the SNAT target.

Hope this give you some ideas to try...

--
Rick
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Problem with Nating rajat83 Linux - Networking 3 04-25-2008 06:03 PM
routing and NATing mwagz Linux - Networking 1 01-31-2007 04:39 AM
Problem with NATing gpagedar Linux - Networking 5 01-28-2006 09:04 PM
iptables twice nating beno123 Linux - Networking 0 07-27-2005 03:41 AM
Nating ... suvajit Linux - Networking 3 05-15-2003 08:09 AM


All times are GMT -5. The time now is 04:45 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration