I am attempting to set up a box as an iptables firewwall. I have the web server sitting behind it and need to forward all port 80 traffic to and from the web server. I have read through the forums (very nice posts) but still can't get anything working.

My $INET_IP changes randomly.
My $INET_IF is pppo
My $LAN_IF is eth0
The LAN subnet is 192.168.0.0/24

Here's the basic configuration I'm working with:

iptables -t nat -A PREROUTING -s 192.168.0.0/24 -d 0/0 -j MASQUERADE

iptables -t nat -A PREROUTING -p tcp --dport 80 -i ppp0 -j DNAT --to 192.168.0.55

iptables -A FORWARD -p tcp --dport 80 -o eth0 -d 192.168.0.55 -j ACCEPT

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to $INET_IP

Obviously, this is only to allow forwarded traffic from the LAN to the Internet, and to forward port 80 traffic to and from the web server. It looks like it should work. What am I missing?

Hi,

Well it should work pretty much as you have it already - presumably you have ip forwarding turned on in the /proc filesystem ?

echo 1 > /proc/sys/net/ipv4/ip_forward
/sbin/modprobe iptable_nat
/sbin/iptables -t nat -A PREROUTING -s 192.168.0.0/24 -d 0/0 -o ppp0 -j MASQUERADE
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -i ppp0 -j DNAT --to 192.168.0.55

Regards

Thanks for the post. I verified that the module was loaded. It is. All the iptables modules are loaded correctly. As for forwarding, I turn it on by editing /etc/sysctl.conf and making it a permanent change in that file (that file will preload the echo > 1 ... command automatically at boot so that I don't have to script it.)

The major problem that appears to be happening is that when I set this up, port 80 traffic doesn't get routed.

I've tried both the lines you've listed and the ones in my previous post. It just doesn't seem to work. I'm assuming at this point that's it's something really simple that I've overlooked.

Fixed my first problem. Apparently, there was some old information in my script from a previous firewall that I was trying to build. Once I cleared that out and set up the rules as I had them, things worked great.

Now there's one other problem, how do I get traffic from one domain to forward to my internal box, while the rest of the machines on the network go out to the internet for www traffic? I haven't seen anything posted to this effect, and I haven't seen anything in either the iptables howto on linuxdoc, nor several of the other guides I've read through online. If anyone could point me to some good documentation, or another thread, I'd really appreciate it.