Linux - NetworkingThis forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Hi everybody.
I have 2 PC's, one with Windows and one with Linux Fedora Core 2.
The Linux has two ethernet cards, one is connected to a ADSL modem(adress of this card is, let's say 10.1.1.1) and the other one is connected to my windows PC (10.1.0.1).
The windows PC is 10.1.0.2. The Linux machine is there as a router/firewall. Browsing is OK, I can acces the internet from both the Linux and the Windows PC.
Here's the problem:
my modem is set up with a DMZ, so it forwards all inbound traffic to 10.1.1.1(Linux). When someone wants to create a new connection to my Linux, everything is OK, users are able to connect (ofcourse, after apropriate settings are made in the INPUT chain), but when someone wants to connect (create a new connection) to my windows PC, it isn't possible (as the modem forwards all traffic to 10.1.1.1). So I thought: I'll use the Linux firewall to route. I typed:
"iptables -t nat -A PREROUTING -s <some-ip> -p tcp --dport <some-port> -j DNAT --to-destination 10.1.0.2"
This should forward all inbound traffic from an internet IP destined to a specific port to my Windows PC directly.
The problem is that it doesn't. I checked the counters and it seems to me that not all incoming packets come trough this chain and none packets are matched with the rule I speciefied. Is the PREROUTING chain behind the Input chain and do I need to approve the new connection as INPUT also (now, it would not pass the INPUT chain)? Or am I doing wrong something else?
Thank you
However, after the routing decision, the packet will run through either INPUT, OUTPUT or FORWARD chain of the filter table. In your case, it will be FORWARD. For each DNAT line in nat/PREROUTING you should have a corresponding line in filter/FORWARD, like:
According to your explanation, if the <some-ip> tryes to send data to <some-port> and those finish on 10.1.1.1, the firewall should match this packet and change it, right? Regardless of the setting in the FORWARD chain, if the counter in the PREROUTING chain says that it hasn't matched any connection(and <some-ip> tryed a few times), than none packes were changed? Or do the counters in the PREROUTING work different?
Never the less, I'll try again, and post the result.
Thanks
No, it didn't help.
I did "iptables -A FORWARD -s <some-ip> -p tcp --dport <some-port> -j ACCEPT". I zeroed the counters, and the result is the same. Nither one of the rules in the PREROUTING chain and in the FORWARD chain have been matched. I don't understand why.
1. when a packet starting a connection comes in, the PREROUTING chain is consulted first, then come the INPUT/FORWARD chains depending on the destination, right?
2. are there any other things that need to be set up apart from iptables?
Please help me, I'm desperate here.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.