LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 06-08-2016, 03:40 AM   #1
griswold27
LQ Newbie
 
Registered: Jun 2016
Posts: 3

Rep: Reputation: Disabled
DNAT newb question


PcA-----------------|eth0:0 /Router/ eth0|-------------------PcB
.4_____10.0.0.0/24___.1_______________.14___192.168.1.0/24___.16

I'v started 3 VirtualMachines Ubuntu
I'v created allias virtual interface eth0:0 (10.0.0.1)
PcA default gateway .1 , and default route to .1
PcB doesnt know about 10.0.0.0/24

iptables -P INPUT ACCEPT
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A FORWARD -i eth0:0 -o eth0 -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth0:0 -p tcp --dport 22 -j ACCEPT
(or this instead: iptables -A FORWARD -p tcp -d 10.0.0.4 --dport 22 -j ACCEPT)
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 22 -j DNAT --to-destination 10.0.0.4:22
echo 1 > /proc/sys/net/ipv4/ip_forward

From PcB:
ssh 192.168.1.14 ---> ssh to 10.0.0.4 doesnt work??
But if: iptables -P FORWARD ACCEPT then it works.
I cant find what is wrong in FORWARD chains, when default action is DROP on FORWARD...
 
Old 06-08-2016, 11:31 AM   #2
lazydog
Senior Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
If you want to see what is going on then use tcpdump to look at the traffic.
If tcpdump doesn't work for you you could add logging to your firewall and look there to see what is going on.

Can't make heads nor tails of your network layout above.
 
Old 06-08-2016, 03:33 PM   #3
griswold27
LQ Newbie
 
Registered: Jun 2016
Posts: 3

Original Poster
Rep: Reputation: Disabled
I have solved it finally.

-i and -o parameters were problem i think.
anyway, two forward rules for ssh from pcb to pca to work are:

sudo iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT // let packets from private network out to internet
sudo iptables -A FORWARD -d 10.0.0.4 -p tcp --dport 22 -j ACCEPT //let incoming packets from internet coming on router public interface on port22 to be forwared to private pcA

p.s. whats wrong with layot ? its standard cisco scheme
left is network 10.0.0.0/24 with 10.0.0.4 PCa and a router interface 10.0.0.1
right is network 192.168.1.0/24 with .1 ruter interface and .16 address of pcB

thank u myself for solving this -.-
cheers

Last edited by griswold27; 06-08-2016 at 03:36 PM.
 
Old 06-09-2016, 07:35 AM   #4
lazydog
Senior Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
Been working with Cisco for a very long time and I've never seen this.

Glad you got it fixed the way you want it to be.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Newb question sicness Slackware 4 11-09-2005 03:40 AM
A few newb question's Abbaddon Slackware 13 09-22-2004 04:58 PM
A Newb Question gnr2k3 Linux - Newbie 1 08-30-2003 04:54 PM
DNAT question (Iptables) wilsonmau Linux - Networking 1 06-06-2003 06:50 AM
Simple iptables DNAT question taylor Linux - General 0 10-02-2001 06:22 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 08:00 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration