Hello,

I'm almost new to linux.

I have used iptable to forward packets to a windows machine on my LAN.
with the following code

/sbin/iptables -t nat -A PREROUTING -i eth1 -j DNAT --to-destination 192.168.x.x

Where 192.168.x.x is a Local LAN computer.

Now I would like to forward packets to different windows machine on my LAN when I get request on different ports through Static IP address.


Assuming the Static IP to be 194.160.1.1

When some one requests at 194.160.1.1:port1
It should forward packets to 192.168.0.1

similarly request on 194.160.1.1:port2 should forward packets to 192.168.0.3 and so on..

Thanks.

regards,
Laxy

/sbin/iptables -t nat -A PREROUTING -i eth1 -j DNAT -p tcp --dport PORTN --to-destination 192.168.x.N

Where PORTN is the port to be forwarded and 192.168.x.N is the internal computer.

Very interesting question. Sadly iptables is not capable of this. Iptables does not allow for variables, which is what you would need to have set with some conditional logic in the rule itself.

There are plenty of so-called iptables scripts that use variables but these variables are always interpreted by the shell (bash, sh, csh, etc) long before the rule is actually added to iptables, so all iptables ever sees of these variables is the resultant output not the variable itself. <--- Probably confusing. Sorry.

You could write a do loop script that would add THOUSANDS (65,535 to be exact) of individual rules to iptables to do just what you ask... but that would bring your firewall to a screeching halt since it would have to parse all that before allowing a packet.

-b

I'm hoping there wasn't intent for THAT many ports. I interpreted the question as one of the syntax of iptables to make it portbased.

Hmm.. yeah know.. I don't know. I thought he meant any port when he said "and so on". I could very well be wrong. Course then again if he's saying 192.168.0.1, that being a class c block then the most he could hope for is forwarding from 192.168.0.2 through 254. Long way from all 65k ports eh? Still having 250ish rules would be heck on an even moderately used firewall.

Anyway I still stand by my point that iptables doesn't use variables only the results of variables.

Sorry if I introduced confusion with my confusion. :-)

-b

Well.... couldn't it be the class B "192.168.0.0/16"? But yes, in either case, it would not be fun for a firewall. Though my firewall has about 100 rules without any noticable lag. Mostly in the FORWARD and INPUT chains. I guess the whole chain deal helps.

I am not sure the syntax like

/sbin/iptables -t nat -A PREROUTING -i eth1 -j DNAT -p tcp --dport PORTN --to-destination 192.168.x.N

will help for multiple different ports to forward packets to different LAN computers.


Here is my modified query.

Assuming the Static IP to be 194.160.1.1

Let the unique ports be 80,81,82

When some one requests at 194.160.1.1:80 It should forward packets to 192.168.0.1
When some one requests at 194.160.1.1:81 It should forward packets to 192.168.0.3
When some one requests at 194.160.1.1:82 It should forward packets to 192.168.0.4

and the list goes similar to the above.

If there are some iptable scripts available online then please guide me where to find a best one.OR any alternative solution for this problem

Thanks,

regards,
Laxy

yes the DNAT rule will do what you need