Prerouting ports with iptables on a firewall

seraph-seph · 11-04-2006, 08:44 AM

Hi everyone.

I've been trying to redirect petitions made to certainly ports (ex. 80) to another linux boxes using one public ip address.

But it haven't work.
here's the code, where eth0 it's the interface connected to internet using a public ip, and eth1 it's the one connected to the LAN. The ip point address for all incoming data throught the port 80 will be 192.168.1.12 and it host an apache webserver

Code:

#!/bin/sh

iptables -F
iptables -X
iptables -Z
iptables -t nat -F

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 192.168.1.12:80

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -s 192.168.1.0/24 -i eth1 -j ACCEPT

#Access to internet 
iptables -A FORWARD -s 192.168.1.0/24 -i eth1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -i eth1 -p tcp --dport 443 -j ACCEPT

## Access to DNS 
iptables -A FORWARD -s 192.168.1.0/24 -i eth1 -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -i eth1 -p udp --dport 53 -j ACCEPT

iptables -A FORWARD -s 192.168.1.0/24 -i eth1 -j DROP

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -A INPUT -s 0.0.0.0/0 -i eth0 -p tcp -dport 1:1024 -j DROP
iptables -A INPUT -s 0.0.0.0/0 -i eth0 -p udp -dport 1:1024 -j DROP

But I can't get it work .. when I type the public address on a web browser it shows the "Could not connect to remote server" message, I don't know what else to do ... for the record .. I type the ip address of the webserver and it shows the welcome website of the server, also I can go outside to internet using the same firewall.

Any idea ... kernel option missing or something?

amitsharma_26 · 11-04-2006, 09:30 AM

Few things :
1. Please make sure that 192.168.1.12(web-server) should have your firewall-box lan-ip as its gateway or we got to write another POSTROUTING rule for this respect as well.

--

Quote:

Originally Posted by seraph-seph

But I can't get it work .. when I type the public address on a web browser it shows the "Could not connect to remote server" message, I don't know what else to do ... for the record .. I type the ip address of the webserver and it shows the welcome website of the server, also I can go outside to internet using the same firewall.

2. You got to use any public-proxy to check whether it is working or not; you cannot check it while sitting on your localbox. During this way; these packets got traverse through OUTPUT chain.

--

Quote:

Originally Posted by seraph-seph

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE

3. As you are having a static public ip; i would suggest you to use SNATing instead of MASQUERADING.

And you should also check iptables port forwarding basics : http://amitsharma.linuxbloggers.com/portforwarding.htm

Brian1 · 11-04-2006, 09:31 AM

Are you trying to access the webserver from within your lan network using the external IP? If so this is probably your issue. Check out this link.
http://iptables-tutorial.frozentux.n...tml#DNATTARGET

There are a few post related to it here using the search feature.

Things to check goto a port checking site like this to see if it open to the outside.
http://www.hackerwatch.org/probe/

Goto an outside site or have a friend or family member from the outside see what they see.

Brian

seraph-seph · 11-04-2006, 12:51 PM

Quote:

Originally Posted by amitsharma_26

Few things :
1. Please make sure that 192.168.1.12(web-server) should have your firewall-box lan-ip as its gateway or we got to write another POSTROUTING rule for this respect as well.

Thanks .. I didn't know that I should set as gateway the LAN IP of the firewall .. The webserver is using another one so I'll use this code since it worked.

Code:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 192.168.1.12:80
iptables -t nat -A POSTROUTING -p tcp -d 192.168.1.12 --dport 80 -j SNAT --to-source ${PUBLIC_IP}

The other thing is that I must comment the line

Code:

iptables -A FORWARD -s 192.168.1.0/24 -i eth1 -j DROP

to get it work. It might be requesting something else...
Thanks a lot

Mario.