Hi,
I managed to get iptables to work and set up NAT on my dsl connection. How do I port forward so people can connect to my HL server and ftp server (on another port other then 21 proftpd already claimed that one)? Also is there a way to view the connections going thourg the router (my linux box)? On the netgear router I used to have, there was a command that would let you see what connections are beeing made thourg it. typing netstat dosent do any good.

Btw. what is the maximum possible connections you can make thourug linux? On my old router it was 256 and after that it wouldnt allow any more connections to be made unless someone dissconected a program using an internet connnection.

so your HL server and ftp server on on a machine that is not the one with the gateway? if they are then what you want to know is how the DNAT rule works check out the NAT HOWTO ay http://www.netfilter.org

if however it is on the same machine you need to alllow connections to that port, read the packet filter HOWTO at the aboce mentioned website.

depends on what you want to view exactly netstat can be used (check man netstat for some of the options) or if you want something the look a bit nicer try ntop (it has a web interface and gives some pretty nifty stats).
There is a limit to how many connections can be tracked,

max connections based on available ram check

http://www.netfilter.org/documentati...q-3.html#ss3.6

they are running on a machine behind the firewall

if you have NAT working, port forwarding is almost the same,

iptables -t nat -A PREROUTING -s <sourceIP> -o <incomming interface> -j DNAT --to-dest <interIPof server>


so lets say you are running a web server on an internal machine who's IP is 192.168.1.100 and u want to forward incomming requests for port 80 to that computer:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-dest 192.168.1.100

that will forward incomming tcp requests for port 80 to the .1.100 box

got it, it works.

btw how do you view traffic that is being pass thourgh the server. I tried all the options and read the man for netstat but it wont show traffic going through using nat. I have a video stream open and 2 ftp connections and i see it going though becuse of the data send and recived values keep going up on ifconfig but i would like to be able to see what people are connecting to? Is there a way to do this?

I have another question for you, Robert0380. I wanna do the same thing. After I get it working, how can I STOP this iptables rule you created? Thx

Chris

Just delete the rule - fore more help:
iptables -h

And look for the information about deleting rules.

Thanks, David! Do you, by any chance, know anything about the sendmail problems I am having which are referenced HERE or HERE ? If anyone can help, I know it's you! Thanks!

Chris

I use a series of DNAT rules to pass connections through to other machines behind my firewall. For each rules stats are kept by iptables

will give you a listing of the totals of each chain. I then use a simple perl script to extract the information I want and utimately I pass this through to mrtg to create pretty pics.

I also do this for normal packet filtered traffic (in other words things that have originated inside my network, http requests, ssh reqests, etc.) and get more graphs.

I also have a rule that matching incoming and another for outgoing traffic that drops through to the next set of chains, thid way I can monitor overall useage simply as well as getting the breakdown (my isp has crappy usage monitoring so I prefer to do my own just in case).

There are also a bunch of tcpdump related bandwidth monitors available that me be better suited.

in addition to this I run ntop which is nice for a quick slice of what is happening (on my machine and one other linux box behind the firewall)