LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 12-28-2007, 06:02 PM   #1
schenke
LQ Newbie
 
Registered: Oct 2007
Location: Iowa
Distribution: Redhat EL 3
Posts: 27

Rep: Reputation: 15
Iptables To Access LAN devices inside&Outside ActionTech DSL


Here is the situation:
I have a ActionTech 701 DSL model/router, running BusyBox embedded linux, seems have iptables running to enable port forwarding.
DSL modem is hooked to a switch, 3 go to other fixed ip PC (2 Windows, 1 RedHat Linux), Redhat has everything( httpd, named, sendmail) and another one goes to Wireless router. 2 Laptops are connected with Wireless router and get access to all other LAN devices and external internet.
The wiring is as following
ISP --> DSL Modem --> Linux (WWW, DNS, POP3, SMTP)
--> WIN PC1
--> WIN PC2
--> Wireless router --> Win PC 3
--> Win Pc 4

The port forwarding is enabled in DSL modem, and works fine in PC1 or 2 according to P2P programs like BT.

The google search result shows that the ActionTech modem has a problem with internal port forwarding, that means PC 1,2,3,4 can not access Linux in port 80, 53,...etc using something like www.murou.com or ns1.murou.com.

I am not sure how to use iptables to resolve this problem. I tried the following but looks like it's not working

Code:
iptables -t nat -A PREROUTING -p tcp -i eth0 -d 6 xxx.xx.xx.xx(public IP) --dport 25 -j DNAT --to 192.168.0.30:25
iptables -A FORWARD -p tcp -i eth0 -d 192.168.0.30 --dport 25 -j ACCEPT
and
Code:
iptables -t nat -A PREROUTING -p tcp -i eth0 -d 192.168.0.1 --dport 25 -j DNAT --to 192.168.0.30:25
iptables -A FORWARD -p tcp -i eth0 -d 192.168.0.30 --dport 25 -j ACCEPT
What's the problem? Help me out... thank you!
since I cannot test my DNS setting, could somebody help me to dig www.murou.com? Thanks!
 
Old 12-30-2007, 12:32 PM   #2
Berhanie
Senior Member
 
Registered: Dec 2003
Location: phnom penh
Distribution: Fedora
Posts: 1,625

Rep: Reputation: 165Reputation: 165
These are rules to allow certain tcp ports to be forwarded your linux box, and to make it possible for internal boxes to access the services using external addresses. You still need to add rules to allow ACCEPTED,RELATED connections, to NAT outgoing packets, etc.

Code:
IF_INET=eth0    # internet-facing interface
IF_LAN=eth1    # lan-facing interface

IP_INET=xx.xx.xx.xx     # IP address of $IF_INET
IP_LAN=192.168.0.1     # IP address of $IF_LAN

LAN_HOST[0]=192.168.0.30  # IP address of linux box
LAN_HOST[1]=192.168.0.xx  # ...
...

NET_LAN=192.168.0.0/24

TCP_PORTS=25,80   # open tcp ports


iptables -A FORWARD -i $IF_LAN -j ACCEPT
iptables -A FORWARD -d ${LAN_HOST[0]} -j ACCEPT

iptables -t nat -A PREROUTING -d $IP_EXT -p tcp -m multiport \
  --dports $TCP_PORTS -j DNAT --to-destination ${LAN_HOST[0]}

# for LAN computers to access each other using external addresses
iptables -t nat -A POSTROUTING -d $NET_LAN -s $NET_LAN \
  -j SNAT --to-source $IP_LAN

Last edited by Berhanie; 12-30-2007 at 12:36 PM.
 
Old 01-01-2008, 01:49 AM   #3
schenke
LQ Newbie
 
Registered: Oct 2007
Location: Iowa
Distribution: Redhat EL 3
Posts: 27

Original Poster
Rep: Reputation: 15
I just tried your script. The IPTable lists the following as execution result:
<code>Chain POSTROUTING (policy ACCEPT)</code>
<code>SNAT all -- 192.168.0.0/24 192.168.0.0/24 to:192.168.0.1</code>

BTW, the modem already has used the following:
<code> MASQUERADE all -- anywhere anywhere</code>

But I still cannot access the 192.168.0.30 through port 80 using WAN IP.

The only solution here is add those names bind to 192.168.0.30 into hosts file.
<code> 192.168.0.30 mail.murou.com </code>

I just tried my mail server, I can send out emails but cannot reply to the address... weird!!
 
Old 01-01-2008, 11:50 AM   #4
Berhanie
Senior Member
 
Registered: Dec 2003
Location: phnom penh
Distribution: Fedora
Posts: 1,625

Rep: Reputation: 165Reputation: 165
As you say, internal DNS is an alternative solution. The point of the iptables rules above is to add the extra SNAT rule, which makes the DNS solution unnecessary. It would be nice to see a dump of all your rules.
 
Old 01-02-2008, 09:57 AM   #5
schenke
LQ Newbie
 
Registered: Oct 2007
Location: Iowa
Distribution: Redhat EL 3
Posts: 27

Original Poster
Rep: Reputation: 15
The modem provides a web interface to set up the port forwarding, but I don't have access to the source code.

Using <Code>iptables -t nat -L </Code>
I can get
<Code>
Chain PREROUTING (policy ACCEPT)
iptables -t nat -A PREROUTING -d $IP_EXT -p tcp --dports $TCP_PORTS -j DNAT --to-destination ${LAN_HOST[0]}
(added by web interface)
Chain POSTROUTING (policy ACCEPT)
MASQUERADE all -- anywhere anywhere (already added by the modem itself)
SNAT all -- 192.168.0.0/24 192.168.0.0/24 to:192.168.0.1 (I added it manually)
</Code>

After I added the postrouting SNAT rule, I cannot use telnet to login into the modem for a while, tried to remove the SNAT entry by another machine.

I will try some sniffer tool.
 
Old 01-02-2008, 01:57 PM   #6
schenke
LQ Newbie
 
Registered: Oct 2007
Location: Iowa
Distribution: Redhat EL 3
Posts: 27

Original Poster
Rep: Reputation: 15
I got some response from ActionTec, they said, due to the limitation of the firmware, it's impossible to access LAN devices using external WAN IP within this LAN.

The firmware actually is running BusyBox embedded Linux, sombody knows what can cause this problem?

ActionTec DSL modems is widely used by Qwest DSL users.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
allow internet access from LAN using IPTABLES cccc Linux - Networking 2 03-24-2006 05:47 PM
LAN & DSL simultaneously? Blaumieser Linux - Newbie 8 09-25-2004 03:42 PM
Lan & DSL simultaneously? (once again) Blaumieser Linux - Networking 0 09-23-2004 03:33 AM
IPTABLES NAT Gateway, No Access from the inside? nweaver916 Linux - Networking 2 08-27-2004 04:46 PM
Apache 2 Server - Can't access it via ip address from inside LAN Robstro Linux - Networking 1 06-30-2004 02:50 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 10:52 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration