Forward OR PreRouting

davidz · 09-24-2007, 10:04 AM

I have an iptables firewall that is working great. My question is, is it better to use the PREROUTING or FORWARD to do "port forwarding". Like for bittorrent for example. I've seen it both ways, and I am already using PREROUTING DNAT/SNAT for my web server and email server. I just need to open up some ports for stuff like bittorrent and such. Should I just add more PREROUTING rules or should I be using FORWARD? Or does it even matter?

Thanks,
David

almatic · 09-24-2007, 10:32 AM

you will need rules in prerouting as well as in forward. The prerouting rule is for the nat (swapping ip addresses) and the forward rule sends the packet to its destination.

win32sux · 09-24-2007, 07:11 PM

Adding to what almatic said, when setting the DNAT in PREROUTING, the only reason why you would NOT need to make a respective FORWARD rule would be if your FORWARD chain is already set to forward these packets. So ideally, you want to have things set so that you definitely *need* to make a respective FORWARD rule(s) for your DNAT(s). Using BitTorrent as an example, we could say that this:

Code:

iptables -t nat -A PREROUTING -p TCP -i $WAN_IFACE --dport 6881:6999 -j DNAT \
--to-destination 192.168.1.112

Should *hopefully* require a rule like this in order to work:

Code:

iptables -A FORWARD -p TCP -i $WAN_IFACE -o $LAN_IFACE -d 192.168.1.112 \
--dport 6881:6999 -m state --state NEW -j ACCEPT

If not, then it's likely your FORWARD chain wasn't reasonably tight.

davidz · 09-25-2007, 07:13 AM

Thanks for the info!! I need to look where I went wrong with not having to have a forward rule at this point.

--David