Routing with iptables
 

Hi everybody.
I have 2 PC's, one with Windows and one with Linux Fedora Core 2.
The Linux has two ethernet cards, one is connected to a ADSL modem(adress of this card is, let's say 10.1.1.1) and the other one is connected to my windows PC (10.1.0.1).
The windows PC is 10.1.0.2. The Linux machine is there as a router/firewall. Browsing is OK, I can acces the internet from both the Linux and the Windows PC.
Here's the problem:
my modem is set up with a DMZ, so it forwards all inbound traffic to 10.1.1.1(Linux). When someone wants to create a new connection to my Linux, everything is OK, users are able to connect (ofcourse, after apropriate settings are made in the INPUT chain), but when someone wants to connect (create a new connection) to my windows PC, it isn't possible (as the modem forwards all traffic to 10.1.1.1). So I thought: I'll use the Linux firewall to route. I typed:
"iptables -t nat -A PREROUTING -s <some-ip> -p tcp --dport <some-port> -j DNAT --to-destination 10.1.0.2"
This should forward all inbound traffic from an internet IP destined to a specific port to my Windows PC directly.
The problem is that it doesn't. I checked the counters and it seems to me that not all incoming packets come trough this chain and none packets are matched with the rule I speciefied. Is the PREROUTING chain behind the Input chain and do I need to approve the new connection as INPUT also (now, it would not pass the INPUT chain)? Or am I doing wrong something else?
Thank you

The PREROUTING chain of the nat table is the first to be checked, see the diagram on
http://www.linuxguruz.com/iptables/h...s-HOWTO-5.html

However, after the routing decision, the packet will run through either INPUT, OUTPUT or FORWARD chain of the filter table. In your case, it will be FORWARD. For each DNAT line in nat/PREROUTING you should have a corresponding line in filter/FORWARD, like:

"iptables -A FORWARD -s <some-ip> -p tcp -d 10.1.0.2 --dport <some-port> -j ACCEPT"

Regards
ric.

Weird
 

According to your explanation, if the <some-ip> tryes to send data to <some-port> and those finish on 10.1.1.1, the firewall should match this packet and change it, right? Regardless of the setting in the FORWARD chain, if the counter in the PREROUTING chain says that it hasn't matched any connection(and <some-ip> tryed a few times), than none packes were changed? Or do the counters in the PREROUTING work different?
Never the less, I'll try again, and post the result.
Thanks

Result
 

No, it didn't help.
I did "iptables -A FORWARD -s <some-ip> -p tcp --dport <some-port> -j ACCEPT". I zeroed the counters, and the result is the same. Nither one of the rules in the PREROUTING chain and in the FORWARD chain have been matched. I don't understand why.
1. when a packet starting a connection comes in, the PREROUTING chain is consulted first, then come the INPUT/FORWARD chains depending on the destination, right?
2. are there any other things that need to be set up apart from iptables?
Please help me, I'm desperate here.

try "-I" instaed of "-A"
like this:
iptables -I FORWARD -s <some-ip> -p tcp --dport <some-port> -j ACCEPT
iptables -t nat -I PREROUTING -s <some-ip> -p tcp --dport <some-port> -j DNAT --to-destination 10.1.0.2

good luck.