LinuxQuestions.org - Port Forwarding trouble with iptables on ubuntu gateway

I have a template for an rc.DHCP.firewall script that allows a person to setup a router that performs masquerading and, ideally, will forward ports 22, 80, etc to my local server.

EVERYTHING works (ie, there are no errors from iptables, and clients are able to view internet fine), but when i try www.elgrandomain.com, it says "Connection failed. Though the site seems valid, the browser was unable to establish a connection."

can anyone help me fix my script please?

here's my script.

Code:

#!/bin/sh

#

# rc.DHCP.firewall - DHCP IP Firewall script for Linux 2.4.x and iptables

#

# Copyright (C) 2001  Oskar Andreasson &lt;bluefluxATkoffeinDOTnet&gt;

#

# This program is free software; you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation; version 2 of the License.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program or from the site that you downloaded it

# from; if not, write to the Free Software Foundation, Inc., 59 Temple

# Place, Suite 330, Boston, MA  02111-1307  USA

#



###########################################################################

#

# 1. Configuration options.

#



echo -n "Configuring Firewall..."



#

# 1.1 Internet Configuration.

#



INET_IFACE="eth0"



#

# 1.1.1 DHCP

#



#

# Information pertaining to DHCP over the Internet, if needed.

#

# Set DHCP variable to no if you don't get IP from DHCP. If you get DHCP

# over the Internet set this variable to yes, and set up the proper IP

# address for the DHCP server in the DHCP_SERVER variable.

#



DHCP="yes"

DHCP_IFACE="eth0"

INET_IP=`ifconfig $INET_IFACE | grep inet | cut -d : -f 2 | cut -d ' ' -f 1`



#

# 1.1.2 PPPoE

#



# Configuration options pertaining to PPPoE.

#

# If you have problem with your PPPoE connection, such as large mails not

# getting through while small mail get through properly etc, you may set

# this option to "yes" which may fix the problem. This option will set a

# rule in the PREROUTING chain of the mangle table which will clamp

# (resize) all routed packets to PMTU (Path Maximum Transmit Unit).

#

# Note that it is better to set this up in the PPPoE package itself, since

# the PPPoE configuration option will give less overhead.

#



PPPOE_PMTU="no"



#

# 1.2 Local Area Network configuration.

#

# your LAN's IP range and localhost IP. /24 means to only use the first 24

# bits of the 32 bit IP address. the same as netmask 255.255.255.0

#



LAN_IP="10.11.12.1"

LAN_IP_RANGE="10.11.12.0/24"

LAN_IFACE="eth1"



#

# 1.3 DMZ Configuration.

#



# not really DMZ, but internal server



LAN_SERVER="10.11.12.10"



#

# 1.4 Localhost Configuration.

#



LO_IFACE="lo"

LO_IP="127.0.0.1"



#

# 1.5 IPTables Configuration.

#



IPTABLES="/sbin/iptables"



#

# 1.6 Other Configuration.

#



###########################################################################

#

# 2. Module loading.

#



#

# Needed to initially load modules

#



/sbin/depmod -a



#

# 2.1 Required modules

#



/sbin/modprobe ip_conntrack

/sbin/modprobe ip_tables

/sbin/modprobe iptable_filter

/sbin/modprobe iptable_mangle

/sbin/modprobe iptable_nat

/sbin/modprobe ipt_LOG

/sbin/modprobe ipt_limit

/sbin/modprobe ipt_MASQUERADE



#

# 2.2 Non-Required modules

#



#/sbin/modprobe ipt_owner

#/sbin/modprobe ipt_REJECT

#/sbin/modprobe ip_conntrack_ftp

#/sbin/modprobe ip_conntrack_irc

#/sbin/modprobe ip_nat_ftp

#/sbin/modprobe ip_nat_irc



###########################################################################

#

# 3. /proc set up.

#



#

# 3.1 Required proc configuration

#



echo "1" > /proc/sys/net/ipv4/ip_forward



#

# 3.2 Non-Required proc configuration

#



#echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

#echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp

echo "1" > /proc/sys/net/ipv4/ip_dynaddr



###########################################################################

#

# 4. rules set up.

#



######

# 4.1 Filter table

#



#

# 4.1.1 Set policies

#



$IPTABLES -P INPUT DROP

$IPTABLES -P OUTPUT DROP

$IPTABLES -P FORWARD DROP



#

# 4.1.2 Create userspecified chains

#



#

# Create chain for bad tcp packets

#



$IPTABLES -N bad_tcp_packets



#

# Create separate chains for ICMP, TCP and UDP to traverse

#



$IPTABLES -N allowed

$IPTABLES -N tcp_packets

$IPTABLES -N udp_packets

$IPTABLES -N icmp_packets



#

# 4.1.3 Create content in userspecified chains

#



#

# bad_tcp_packets chain

#



$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \

-m state --state NEW -j REJECT --reject-with tcp-reset

$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \

--log-prefix "New not syn:"

$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP



#

# allowed chain

#



$IPTABLES -A allowed -p TCP -d $LAN_SERVER -j ACCEPT

$IPTABLES -A allowed -p TCP --syn -j ACCEPT

$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A allowed -p TCP -j DROP





#

# TCP rules

#



$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed



#

# UDP ports

#



$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT

$IPTABLES -A udp_packets -p UDP -i $DHCP_IFACE --sport 67 \

--dport 68 -j ACCEPT



$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT

$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT



#

# In Microsoft Networks you will be swamped by broadcasts. These lines

# will prevent them from showing up in the logs.

#



$IPTABLES -A udp_packets -p UDP -i $INET_IFACE \

--destination-port 135:139 -j DROP



#

# If we get DHCP requests from the Outside of our network, our logs will

# be swamped as well. This rule will block them from getting logged.

#



$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d 255.255.255.255 \

--destination-port 67:68 -j DROP



#

# ICMP rules

#



$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT

$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT



#

# 4.1.4 INPUT chain

#



#

# Bad TCP packets we don't want.

#



$IPTABLES -A INPUT -p tcp -j bad_tcp_packets



#

# Rules for special networks not part of the Internet

#



$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT

$IPTABLES -A INPUT -p ALL -i $LO_IFACE -j ACCEPT



#

# Special rule for DHCP requests from LAN, which are not caught properly 

# otherwise.

#



$IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT



#

# Rules for incoming packets from the internet.

#



$IPTABLES -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED \

-j ACCEPT

$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets

$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets

$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets



#

# If you have a Microsoft Network on the outside of your firewall, you may

# also get flooded by Multicasts. We drop them so we do not get flooded by

# logs

#



#$IPTABLES -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP



#

# Log weird packets that don't match the above.

#



$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \

--log-level DEBUG --log-prefix "IPT INPUT packet died: "



#

# 4.1.5 FORWARD chain

#



#

# Bad TCP packets we don't want

#



$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets



#

# Accept the packets we actually want to forward

#



$IPTABLES -A FORWARD -i $INET_IFACE -d $LAN_SERVER -j ACCEPT

$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT

$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT



#

# Log weird packets that don't match the above.

#



$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG \

--log-level DEBUG --log-prefix "IPT FORWARD packet died: "



#

# 4.1.6 OUTPUT chain

#



#

# Bad TCP packets we don't want.

#



$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets



#

# Special OUTPUT rules to decide which IP's to allow.

#



$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT

$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT

$IPTABLES -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT



#

# Log weird packets that don't match the above.

#



$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \

--log-level DEBUG --log-prefix "IPT OUTPUT packet died: "



######

# 4.2 nat table

#



#

# 4.2.1 Set policies

#



#

# 4.2.2 Create user specified chains

#



#

# 4.2.3 Create content in user specified chains

#



#

# 4.2.4 PREROUTING chain

#



$IPTABLES -t nat -A PREROUTING -p TCP --dport 80 -j DNAT --to-destination \

$LAN_SERVER:80

$IPTABLES -t nat -A PREROUTING -p TCP --dport 22 -j DNAT --to-destination \

$LAN_SERVER:22



#

# 4.2.5 POSTROUTING chain

#



$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE



#

# 4.2.6 OUTPUT chain

#



######

# 4.3 mangle table

#



#

# 4.3.1 Set policies

#



#

# 4.3.2 Create user specified chains

#



#

# 4.3.3 Create content in user specified chains

#



#

# 4.3.4 PREROUTING chain

#



#

# 4.3.5 INPUT chain

#



#

# 4.3.6 FORWARD chain

#



#

# 4.3.7 OUTPUT chain

#



#

# 4.3.8 POSTROUTING chain

#

echo "complete."

Quote:

Originally Posted by repo (Post 3342790)

Seems to me you forgot to add the interface INET_IFACE="eth0"

Let xxx.xxx.xxx.xxx be the IP address of the gateway server connected to the cable modem and 192.168.0.2 ,
the IP address of the internal machine. And say we want to run a web server ( httpd ) on 192,168.0.2 on port 80
which should be avaialble to the outside internet. We can forward the port 80 on xxx.xxx.xxx.xxx to port 80 of 192.168.0.2

/sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 -d xxx.xxx.xxx.xxx
--dport 80 -j DNAT --to 192.168.0.2:80
/sbin/iptables -A FORWARD -p tcp -i eth0 -d 192.168.0.2 --dport 80 -j ACCEPT

Thank you! I added the input interface, and i may have changed something else, but now it works! ... but i'm a little curious why the gateway is not able to ping the external IP address, but it IS able ping anything else... any thoughts?

Here's my up-to-date script:

Code:

#!/bin/sh

#

# rc.DHCP.firewall - DHCP IP Firewall script for Linux 2.4.x and iptables

#

# Copyright (C) 2001  Oskar Andreasson &lt;bluefluxATkoffeinDOTnet&gt;

#

# This program is free software; you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation; version 2 of the License.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program or from the site that you downloaded it

# from; if not, write to the Free Software Foundation, Inc., 59 Temple

# Place, Suite 330, Boston, MA  02111-1307  USA

#



###########################################################################

#

# 1. Configuration options.

#



echo -n "Configuring Firewall..."



#

# 1.1 Internet Configuration.

#



INET_IFACE="eth0"



#

# 1.1.1 DHCP

#



#

# Information pertaining to DHCP over the Internet, if needed.

#

# Set DHCP variable to no if you don't get IP from DHCP. If you get DHCP

# over the Internet set this variable to yes, and set up the proper IP

# address for the DHCP server in the DHCP_SERVER variable.

#



DHCP="yes"

DHCP_IFACE="eth0"

INET_IP=`ifconfig $INET_IFACE | grep inet | cut -d : -f 2 | cut -d ' ' -f 1`



#

# 1.1.2 PPPoE

#



# Configuration options pertaining to PPPoE.

#

# If you have problem with your PPPoE connection, such as large mails not

# getting through while small mail get through properly etc, you may set

# this option to "yes" which may fix the problem. This option will set a

# rule in the PREROUTING chain of the mangle table which will clamp

# (resize) all routed packets to PMTU (Path Maximum Transmit Unit).

#

# Note that it is better to set this up in the PPPoE package itself, since

# the PPPoE configuration option will give less overhead.

#



PPPOE_PMTU="no"



#

# 1.2 Local Area Network configuration.

#

# your LAN's IP range and localhost IP. /24 means to only use the first 24

# bits of the 32 bit IP address. the same as netmask 255.255.255.0

#



LAN_IP="10.11.12.1"

LAN_IP_RANGE="10.11.12.0/24"

LAN_IFACE="eth1"



#

# 1.3 DMZ Configuration.

#



# not really DMZ, but internal server



LAN_SERVER="10.11.12.10"



#

# 1.4 Localhost Configuration.

#



LO_IFACE="lo"

LO_IP="127.0.0.1"



#

# 1.5 IPTables Configuration.

#



IPTABLES="/sbin/iptables"



#

# 1.6 Other Configuration.

#



###########################################################################

#

# 2. Module loading.

#



#

# Needed to initially load modules

#



/sbin/depmod -a



#

# 2.1 Required modules

#



/sbin/modprobe ip_conntrack

/sbin/modprobe ip_tables

/sbin/modprobe iptable_filter

/sbin/modprobe iptable_mangle

/sbin/modprobe iptable_nat

/sbin/modprobe ipt_LOG

/sbin/modprobe ipt_limit

/sbin/modprobe ipt_MASQUERADE



#

# 2.2 Non-Required modules

#



#/sbin/modprobe ipt_owner

#/sbin/modprobe ipt_REJECT

#/sbin/modprobe ip_conntrack_ftp

#/sbin/modprobe ip_conntrack_irc

#/sbin/modprobe ip_nat_ftp

#/sbin/modprobe ip_nat_irc



###########################################################################

#

# 3. /proc set up.

#



#

# 3.1 Required proc configuration

#



echo "1" > /proc/sys/net/ipv4/ip_forward



#

# 3.2 Non-Required proc configuration

#



#echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

#echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp

echo "1" > /proc/sys/net/ipv4/ip_dynaddr



###########################################################################

#

# 4. rules set up.

#



######

# 4.1 Filter table

#



#

# 4.1.1 Set policies

#



$IPTABLES -P INPUT DROP

$IPTABLES -P OUTPUT DROP

$IPTABLES -P FORWARD DROP



#

# 4.1.2 Create userspecified chains

#



#

# Create chain for bad tcp packets

#



$IPTABLES -N bad_tcp_packets



#

# Create separate chains for ICMP, TCP and UDP to traverse

#



$IPTABLES -N allowed

$IPTABLES -N tcp_packets

$IPTABLES -N udp_packets

$IPTABLES -N icmp_packets



#

# 4.1.3 Create content in userspecified chains

#



#

# bad_tcp_packets chain

#



$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \

-m state --state NEW -j REJECT --reject-with tcp-reset

$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \

--log-prefix "New not syn:"

$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP



#

# allowed chain

#



$IPTABLES -A allowed -p ALL -d $LAN_SERVER -j ACCEPT

$IPTABLES -A allowed -p TCP --syn -j ACCEPT

$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A allowed -p TCP -j DROP





#

# TCP rules

#



$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed



#

# UDP ports

#



$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT

$IPTABLES -A udp_packets -p UDP -i $DHCP_IFACE --sport 67 \

--dport 68 -j ACCEPT



$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT

$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT



#

# In Microsoft Networks you will be swamped by broadcasts. These lines

# will prevent them from showing up in the logs.

#



$IPTABLES -A udp_packets -p UDP -i $INET_IFACE \

--destination-port 135:139 -j DROP



#

# If we get DHCP requests from the Outside of our network, our logs will

# be swamped as well. This rule will block them from getting logged.

#



$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d 255.255.255.255 \

--destination-port 67:68 -j DROP



#

# ICMP rules

#



$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT

$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT



#

# 4.1.4 INPUT chain

#



#

# Bad TCP packets we don't want.

#



$IPTABLES -A INPUT -p tcp -j bad_tcp_packets



#

# Rules for special networks not part of the Internet

#



$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT

$IPTABLES -A INPUT -p ALL -i $LO_IFACE -j ACCEPT



#

# Special rule for DHCP requests from LAN, which are not caught properly 

# otherwise.

#



$IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT



#

# Rules for incoming packets from the internet.

#



$IPTABLES -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED \

-j ACCEPT

$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets

$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets

$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets



#

# If you have a Microsoft Network on the outside of your firewall, you may

# also get flooded by Multicasts. We drop them so we do not get flooded by

# logs

#



#$IPTABLES -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP



#

# Log weird packets that don't match the above.

#



$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \

--log-level DEBUG --log-prefix "IPT INPUT packet died: "



#

# 4.1.5 FORWARD chain

#



#

# Bad TCP packets we don't want

#



$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets



#

# Accept the packets we actually want to forward

#



$IPTABLES -A FORWARD -i $INET_IFACE -d $LAN_SERVER -j ACCEPT

$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT

$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT



#

# Log weird packets that don't match the above.

#



$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG \

--log-level DEBUG --log-prefix "IPT FORWARD packet died: "



#

# 4.1.6 OUTPUT chain

#



#

# Bad TCP packets we don't want.

#



$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets



#

# Special OUTPUT rules to decide which IP's to allow.

#



$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT

$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT

$IPTABLES -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT



#

# Log weird packets that don't match the above.

#



$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \

--log-level DEBUG --log-prefix "IPT OUTPUT packet died: "



######

# 4.2 nat table

#



#

# 4.2.1 Set policies

#



#

# 4.2.2 Create user specified chains

#



#

# 4.2.3 Create content in user specified chains

#



#

# 4.2.4 PREROUTING chain

#



$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 80 \

-j DNAT --to-destination $LAN_SERVER

$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $INET_IP --dport 22 \

-j DNAT --to-destination $LAN_SERVER



#

# 4.2.5 POSTROUTING chain

#



$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE



#

# 4.2.6 OUTPUT chain

#



######

# 4.3 mangle table

#



#

# 4.3.1 Set policies

#



#

# 4.3.2 Create user specified chains

#



#

# 4.3.3 Create content in user specified chains

#



#

# 4.3.4 PREROUTING chain

#



#

# 4.3.5 INPUT chain

#



#

# 4.3.6 FORWARD chain

#



#

# 4.3.7 OUTPUT chain

#



#

# 4.3.8 POSTROUTING chain

#

echo "complete."