Visit Jeremy's Blog.
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 08-12-2008, 05:16 AM   #1
LQ Newbie
Registered: Jan 2008
Posts: 9

Rep: Reputation: 0
Unhappy port forwarding to internal web-server using iptables

Greetings to all!

We are re-configuring our network. We want to route all external traffic through a dual-NIC gateway machine which will be running squid along with iptables. The clients are currently directly connected to the internet ie on each of them, the ISP's router is set as the gateway. We want the clients to connect to the internet through the gateway machine. The gateway machine would, in turn, connect to the ISP's router.

I'm now halfway into the migration process. The squid machine is up and running and all the clients (now with internal IPs) can connect to the net. However,the problem is that, we also have two web-servers running on internal machines plus a DNS server on another machine which need to be accessible from outside. Before the re-configuration, all these machines had public IPs and hence were accessible from outside, but now, after their conversion to local addresses, this is no longer the case.

I want to use iptables to set up port forwarding at the gateway so that any TCP or DNS request automatically gets forwarded to the relevant machines.

Two questions are plaguing me however:

1)will it be necessary to actually set the (external)IPs of the web and dns servers on the gateway machine or will iptables trap the packets by simply observingthe IP adds of the packets when they are routed to the gateway machine from the ISP end?

2)what will be the NATting rules like? will it be something like:

#iptables -t nat -I PREROUTING -p tcp -i eth0 --dport 80 -j DNAT --to-dest\

Any help will be gratefully accepted.
Thanks in advance!
Old 08-12-2008, 05:52 AM   #2
Senior Member
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,629

Rep: Reputation: Disabled
I feel yes this is true. You will need the live IP address of the web servers you have to be set up either on the servers running apache and put them directly online or on gateway and route the appropriate traffic on servers. The second option is better as this will encapsulate your web server from the external traffic and secure them.
This can be done using Iptables the same way you mentioned. But you will need to give some attention when making policies about the iptables rules to route the appropriate traffic to your web server and still other systems are on internet. This should not be very difficult but still being cautious will help.
Old 08-12-2008, 10:26 AM   #3
Registered: Jun 2006
Location: Johannesburg, South Africa
Distribution: Ubuntu, CentOS, Debian
Posts: 47

Rep: Reputation: 15
You might also want to look at running squid in accelerator mode. You can also then filter out inappropriate requests as needed, for example someone trying to attack your webserver...
Old 08-13-2008, 03:22 AM   #4
LQ Newbie
Registered: Jan 2008
Posts: 9

Original Poster
Rep: Reputation: 0
Thanks, guys !


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Forwarding Ports on DSL modem to IPCOP box, then Internal Web Server benmay05 Linux - Networking 2 05-07-2007 03:34 AM
iptables forwarding to internal server pyloth Linux - Security 4 04-17-2005 12:51 PM
Can't browse internal web server using iptables iel Linux - Networking 7 03-25-2004 12:56 AM
iptables does not allow me to access internal web server. JawjLindo Linux - Security 2 11-10-2003 02:23 PM
IPTABLES port forwarding to internal network ivanros Linux - Networking 2 12-28-2002 10:19 PM > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 09:21 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration