LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 08-19-2005, 02:28 PM   #1
sl_king
LQ Newbie
 
Registered: Aug 2005
Posts: 3

Rep: Reputation: 0
iptables: if connected to localhost, forward to remote ip


Hi All,

Here is the problem I'm trying to solve by iptables. I need to forward local tcp connections to remote host. Let's say there are 2 hosts : 192.168.1.1 and 192.168.1.2.

When somebody tries to connect to 192.168.1.1:22, I want this connection to be redirected to 192.168.1.2:2244. This would be a simple port forwarding, but I want this to be active for localhost. I.e. when I execute "telnet localhost 22" from within 192.168.1.1, I want to end up connecting to 192.168.1.2:2244.

How to configure this with iptables?

Thanks!
 
Old 08-19-2005, 05:34 PM   #2
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 48
Try..
iptables -t nat -I PREROUTING -i lo -d 127.0.0.1 -p tcp --dport 22 -j DNAT --to-destination 192.168.1.2:2244

It will be important which rule number this is to make sure nothing before it takes it out of the chain, so this will place the rule first, and you can put it in it's correct position later.
 
Old 08-19-2005, 06:22 PM   #3
sl_king
LQ Newbie
 
Registered: Aug 2005
Posts: 3

Original Poster
Rep: Reputation: 0
Code:
iptables -t nat -I PREROUTING -i lo -d 127.0.0.1 -p tcp --dport 22 -j DNAT --to-destination 192.168.1.2:2244
iptables does not compain, but does not work, either...

Code:
root@dev-2# telnet localhost 22
Trying ::1...
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused
Service is running at 192.168.1.2:2244. I mean "telnet 192.168.1.2 2244" connects.

Any other ideas?..
 
Old 08-19-2005, 06:36 PM   #4
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 48
The replying packets need to be natted to look like they are from 127.0.0.1..

That will take some extra trickery..
WIll have to think some more..
 
Old 08-19-2005, 06:52 PM   #5
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 48
Add a log rule to the outgoing interface to see what source ip address is being used..

iptables -t nat -A POSTROUTING -o eth? -d 192.168.1.2 --dport 2244 -j LOG --log-level 6 --log-prefix "checkme "

If the packets are leaving with 127.0.0.1 as a source address, add..
iptables -t nat -A POSTROUTING -o eth? -d 192.168.1.2 --dport 2244 -j MASQUERADE

(Ideally, it should be a SNAT rule with the appropriate ip number of the interface..)

Last edited by peter_robb; 08-19-2005 at 06:53 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
forward mails to a remote address - sendmail ddaas Linux - Networking 1 09-14-2005 02:54 AM
iptables FORWARD Ipolit Slackware 16 06-09-2005 04:35 PM
using sendmail to forward to a remote smtp server selgip Linux - Software 1 03-21-2005 05:04 PM
iptables forward? Bambi Linux - Security 2 10-02-2003 10:15 AM
iptables FORWARD ArnaudVR Linux - Security 6 07-07-2003 05:05 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 06:05 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration