LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 12-17-2007, 11:33 AM   #1
lorga
LQ Newbie
 
Registered: Jan 2006
Posts: 2

Rep: Reputation: 0
Simple iptable rules


I need help with iptable
I have a fedora8 server doing squid proxy and firewall with few computer in the network

the clients can go to the internet with no problem the problem that I have is, I can not make anybody see my web page from the internet. I just need a simple comfiguration to fordward the port 80, 443 and 25 to my internal server. My iptable comfigurationis this
I have to ethernet
eth0 is internal network
eth1 is external network

# Generated by iptables-save v1.3.8 on Sun Dec 16 23:46:10 2007
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth1 -j MASQUERADE
# Forward HTTP connections to Squid proxy
-A PREROUTING -p tcp -m tcp -i eth0 --dport 80 -j REDIRECT --to-ports 3128
-A PREROUTING -p tcp -m tcp -i eth1 --dport 80 -j DNAT --to-destination 192.168.0.20:80
-A PREROUTING -p tcp -m tcp -i eth1 --dport 443 -j DNAT --to-destination 192.168.0.20:443
COMMIT
# Completed on Sun Dec 16 23:46:10 2007
# Generated by iptables-save v1.3.8 on Sun Dec 16 23:46:10 2007
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed on Sun Dec 16 23:46:10 2007
# Generated by iptables-save v1.3.8 on Sun Dec 16 23:46:10 2007
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -p tcp -m tcp -m state -i eth1 --dport 80 --state NEW -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
COMMIT
# Completed on Sun Dec 16 23:46:10 2007

I've been looking for any help in the internet but I and not able to find nothing please if somebody can give me so clue what a am doing wrong, I will apriciate it.
 
Old 12-17-2007, 12:46 PM   #2
sparc86
Member
 
Registered: Jul 2006
Location: Joinville, Southern Brazil
Distribution: Debian, CentOS
Posts: 296

Rep: Reputation: 31
I believe it's lacking the following rule:

iptables -t nat -A POSTROUTING -o <internal_interface> -p tcp --dport 80 -j SNAT --to-source <firewall_ip>


Please tell us if this worked.
 
Old 12-17-2007, 12:52 PM   #3
fritzah
LQ Newbie
 
Registered: Oct 2003
Posts: 3

Rep: Reputation: 0
Does iptables start correctly with this syntax you are using? I have not seen -m (--match state option or -m for multiport) used with the entire protocol of tcp such as what you have listed in your prerouting chains.
 
Old 12-17-2007, 01:30 PM   #4
lorga
LQ Newbie
 
Registered: Jan 2006
Posts: 2

Original Poster
Rep: Reputation: 0
yes I dont get any error, when I start the iptable
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
IPTable rules RecoilUK Linux - Security 1 05-27-2005 08:25 PM
Verifying IPTable rules... Ateo Linux - Networking 1 02-02-2005 04:33 PM
Help with IPtable Rules aqoliveira Linux - Security 3 12-10-2003 11:00 AM
iptable-rules for eDonkey? grubjo Linux - Networking 2 08-01-2002 07:38 AM
Iptable rules for Gnutella al_erola Linux - Security 5 03-06-2002 04:21 AM


All times are GMT -5. The time now is 06:24 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration