LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
Reload this Page Iptables putting a nat (port forwarding)
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-31-2008, 03:13 AM   #1
procfs
Member
 
Registered: Jan 2006
Location: Sri Lanka
Posts: 651

Rep: Reputation: 34
Iptables putting a nat (port forwarding)

Hi

I have a Redhat box running iptables Linux kernel 2.4.9-e.49, I am trying to do a port forwarding as

When ever a user comes to eth0 using http://203.x.x.x:100 should be directed to 192.168.X.X:80. I have enter the fallowing nat

-A PREROUTING -i eth0 -p tcp --dport 100 -j DNAT --to-destination 192.168.234.22:80

Is this correct if so this is not working, can someone help how to do this


thanks
 
Old 01-31-2008, 03:26 AM   #2
Tinkster
Moderator
 
Registered: Apr 2002
Location: earth
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928
Hard to say w/o knowing the entire rule-set, but I would have guessed
that it's
Code:
-A FORWARD -p tcp -i eth0 -dport 100 -d 192.168.234.22 -j ACCEPT
-t nat -A PREROUTING -p tcp -i eth0 -dport 100 -j DNAT --to-destination 192.168.234.22:80
together?




Cheers,
Tink
 
Old 01-31-2008, 04:18 AM   #3
procfs
Member
 
Registered: Jan 2006
Location: Sri Lanka
Posts: 651

Original Poster
Rep: Reputation: 34
Hi Tinkster

I add

-A FORWARD -p tcp -i eth0 --dport 100 -d 192.168.11.11 -j ACCEPT

but when I do service iptables restart I get thi error

[root@fuzzy root]# service iptables restart
Resetting built-in chains to the default ACCEPT policy: [ OK ]
Flushing all current rules and user defined chains: [ OK ]
Clearing all current rules and user defined chains: [ OK ]
Applying iptables firewall rules: [ OK ]
iptables-restore v1.2.5: Unknown arg `--dport'
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
 
Old 01-31-2008, 04:26 AM   #4
procfs
Member
 
Registered: Jan 2006
Location: Sri Lanka
Posts: 651

Original Poster
Rep: Reputation: 34
Hi Tinkster

by changing your entry as

-A FORWARD -p tcp -i eth0 -m tcp --dport 100 -d 192.168.11.11 -j ACCEPT

Iptables started with out an issue but the original problem is still there the nating is not working

Thanks

Regards
 
Old 02-05-2008, 01:09 AM   #5
procfs
Member
 
Registered: Jan 2006
Location: Sri Lanka
Posts: 651

Original Poster
Rep: Reputation: 34
Can some one help me on this pleas
 
Old 02-05-2008, 02:45 AM   #6
Tinkster
Moderator
 
Registered: Apr 2002
Location: earth
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928Reputation: 928
Can you post your entire rule-set?



Cheers,
Tink
 
Old 02-06-2008, 09:56 PM   #7
procfs
Member
 
Registered: Jan 2006
Location: Sri Lanka
Posts: 651

Original Poster
Rep: Reputation: 34
Hi below is my iptable entries,

# Generated by iptables-save v1.2.5 on Fri Aug 20 15:26:57 2004
*nat
:PREROUTING ACCEPT [189587:19329196]
:POSTROUTING ACCEPT [911:52886]
:OUTPUT ACCEPT [1167:70698]
-t nat -A PREROUTING -p tcp -i eth0 -dport 100 -j DNAT --to-destination 192.168.11.11:80
COMMIT
# Completed on Fri Aug 20 15:26:57 2004
# Generated by iptables-save v1.2.5 on Fri Aug 20 15:26:57 2004
*mangle
:PREROUTING ACCEPT [529864:73715662]
:OUTPUT ACCEPT [305992:64946436]
-t nat -A PREROUTING -p tcp -i eth0 -dport 100 -j DNAT --to-destination 192.168.11.11:80
COMMIT
# Completed on Fri Aug 20 15:26:57 2004
# Generated by iptables-save v1.2.5 on Fri Aug 20 15:26:57 2004
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:syn-flood - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j syn-flood
-A INPUT -i eth0 -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -s 192.168.2.2 -i eth0 -j DROP
-A INPUT -s 192.168.3.1 -i eth1 -j DROP
-A INPUT -d 127.0.0.1 -i eth0 -j DROP
-A INPUT -s 127.0.0.1 -i eth0 -j DROP
-A INPUT -d 192.168.2.2 -i eth0 -j DROP
-A INPUT -s 192.168.0.0/255.255.0.0 -i eth0 -j DROP
-A INPUT -s 172.16.0.0/255.240.0.0 -i eth0 -j DROP
-A INPUT -s 10.0.0.0/255.0.0.0 -i eth0 -j DROP
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --sport 22 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --sport 22 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 5223 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 5223 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 192.168.11.215 -i eth1 -j ACCEPT
-A INPUT -s 192.168.11.12 -i eth1 -p tcp -m tcp --sport 389 -j ACCEPT
-A INPUT -s 192.168.11.21 -i eth1 -p tcp -m tcp --sport 389 -j ACCEPT
-A INPUT -s 192.168.11.131 -i eth1 -p tcp -m tcp --sport 389 -j ACCEPT
-A INPUT -s 192.168.11.3 -i eth1 -p tcp -m tcp --sport 389 -j ACCEPT
-A INPUT -s 192.168.11.3 -i eth1 -p tcp -m tcp --sport 143 -j ACCEPT
-A INPUT -s 192.168.11.3 -i eth1 -p tcp -m tcp --sport 25 -j ACCEPT
-A INPUT -s 192.168.11.6 -i eth1 -p tcp -m tcp --sport 80 -j ACCEPT
-A INPUT -i eth0 -j LOG --log-prefix "TRAFFIC_ETH0_INPUT: "
-A INPUT -i eth0 -j DROP
-A INPUT -i eth1 -j LOG --log-prefix "TRAFFIC_ETH1_INPUT: "
-A INPUT -i eth1 -j DROP
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -d 127.0.0.1 -i eth0 -j DROP
-A FORWARD -s 127.0.0.1 -i eth0 -j DROP
-A FORWARD -p tcp -i eth0 -dport 100 -d 192.168.11.11 -j ACCEPT
-A FORWARD -s 192.168.0.0/255.255.0.0 -i eth0 -j DROP
-A FORWARD -s 172.16.0.0/255.240.0.0 -i eth0 -j DROP
-A FORWARD -s 10.0.0.0/255.0.0.0 -i eth0 -j DROP
-A FORWARD -o eth0 -p tcp -m tcp --sport 137:139 -j DROP
-A FORWARD -o eth0 -p udp -m udp --sport 137:139 -j DROP
-A FORWARD -o eth0 -j DROP
-A FORWARD -p icmp -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state INVALID -j DROP
-A OUTPUT -o eth0 -p tcp -m tcp --sport 137:139 -j DROP
-A OUTPUT -o eth0 -p udp -m udp --sport 137:139 -j DROP
-A OUTPUT -o eth0 -p tcp -m tcp --sport 22 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --sport 22 -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --sport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --sport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --sport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --sport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --sport 5223 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --sport 5223 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -d 192.168.11.215 -o eth1 -j ACCEPT
-A OUTPUT -d 192.168.11.12 -o eth1 -p tcp -m tcp --dport 389 -j ACCEPT
-A OUTPUT -d 192.168.11.131 -o eth1 -p tcp -m tcp --dport 389 -j ACCEPT
-A OUTPUT -d 192.168.11.21 -o eth1 -p tcp -m tcp --dport 389 -j ACCEPT
-A OUTPUT -d 192.168.11.3 -o eth1 -p tcp -m tcp --dport 389 -j ACCEPT
-A OUTPUT -d 192.168.11.3 -o eth1 -p tcp -m tcp --dport 143 -j ACCEPT
-A OUTPUT -d 192.168.11.3 -o eth1 -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -s 192.168.11.6 -o eth1 -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -j LOG --log-prefix "TRAFFIC_ETH0_OUTPUT: "
-A OUTPUT -o eth0 -j DROP
-A OUTPUT -o eth1 -j LOG --log-prefix "TRAFFIC_ETH1_OUTPUT: "
-A OUTPUT -o eth1 -j DROP
-A syn-flood -m limit --limit 1/sec --limit-burst 4 -j RETURN
-A syn-flood -j DROP
COMMIT
# Completed on Fri Aug 20 15:26:57 2004


The ifconfig -a output as folows, all the routes are working ok

eth0 Link encap:Ethernet HWaddr 00:0C:29:54:E8:FD
inet addr:192.168.2.2 Bcast:192.168.2.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe54:e8fd/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1520515 errors:0 dropped:0 overruns:0 frame:0
TX packets:281 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:127179044 (121.2 MiB) TX bytes:22298 (21.7 KiB)
Interrupt:177 Base address:0x1400

eth0:1 Link encap:Ethernet HWaddr 00:0C:29:54:E8:FD
inet addr:192.168.2.3 Bcast:192.168.2.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Interrupt:177 Base address:0x1400

eth1 Link encap:Ethernet HWaddr 00:0C:29:54:E8:07
inet addr:192.168.3.1 Bcast:192.168.3.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe54:e807/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1579560 errors:0 dropped:0 overruns:0 frame:0
TX packets:61622 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:135610511 (129.3 MiB) TX bytes:9871928 (9.4 MiB)
Interrupt:185 Base address:0x1480

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:8618 errors:0 dropped:0 overruns:0 frame:0
TX packets:8618 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:6250393 (5.9 MiB) TX bytes:6250393 (5.9 MiB)

sit0 Link encap:IPv6-in-IPv4
NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
 
Old 02-12-2008, 02:24 AM   #8
procfs
Member
 
Registered: Jan 2006
Location: Sri Lanka
Posts: 651

Original Poster
Rep: Reputation: 34
Hi

This is the scenario

I have a Redhat box running iptables

1. One virtual interface and tow physical interfaces
a. Eth0 – 10.10.10.1
b. Eth0:1 – 10.10.10.2
c. Eth1 – 192.168.100.1

2. This machine has a apache server running (port 443)
3. I have a another server 192.168.100.245 and apache running (port 443)
4. What I want is

If call comes through eth0 ipaddress 10.10.10.1 port 443
then
this should forward to 192.168.100.245 on port 443

or

If a call comes on Eth0:1 ipaddress 10.10.10.2 port 443
Then
This should go the local apache service

Can some one tell me if this is possible and how to do this, as ip tables do not allow you to add virtual interfaces you are stuck with the eth0 and eth1, I am stuck whit this !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 
Old 02-19-2008, 12:15 AM   #9
procfs
Member
 
Registered: Jan 2006
Location: Sri Lanka
Posts: 651

Original Poster
Rep: Reputation: 34
Hi I have removed all the rules and just add the following but I still can’t do any forwarding. I dont understand what is going on ?????????????? is there any Kernel parameters that I have to check (forwarding is enabled)



# Generated by iptables-save v1.2.5 on Fri Aug 20 15:26:57 2004
*nat
:PREROUTING ACCEPT [189587:19329196]
:POSTROUTING ACCEPT [911:52886]
:OUTPUT ACCEPT [1167:70698]
-A PREROUTING -p tcp -m tcp -i eth0 --dport 443 -j DNAT --to-destination 192.168.11.234
-A PREROUTING -p tcp -m tcp -i eth0 --dport 80 -j DNAT --to-destination 192.168.11.243
#-A PREROUTING -d 203.143.24.123 -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.11.26:25
#-A PREROUTING -i eth0 -d 203.143.24.126 -p tcp --dport 443 -j DNAT --to-destination 192.168.11.11
COMMIT
# Completed on Fri Aug 20 15:26:57 2004
# Generated by iptables-save v1.2.5 on Fri Aug 20 15:26:57 2004
*mangle
:PREROUTING ACCEPT [529864:73715662]
:OUTPUT ACCEPT [305992:64946436]
COMMIT
# Completed on Fri Aug 20 15:26:57 2004
# Generated by iptables-save v1.2.5 on Fri Aug 20 15:26:57 2004
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:syn-flood - [0:0]
-A FORWARD -p tcp -m tcp -i eth0 --dport 443 -d 192.168.11.243 -j ACCEPT
-A FORWARD -p tcp -m tcp -i eth0 --dport 80 -d 192.168.11.243 -j ACCEPT
COMMIT
# Completed on Fri Aug 20 15:26:57 2004
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables nat port forwarding rule set crowhurst01 Linux - Networking 2 02-13-2012 03:39 AM
NAT and Port Forwarding aq_mishu Linux - Networking 2 09-16-2005 07:58 AM
Port Forwarding without NAT on an old Kernel linuxpyro Linux - Networking 0 06-02-2004 12:31 PM
iptables + NAT + Port forwarding problem SirGertrude Linux - Networking 9 05-14-2004 04:02 AM
NAT Port forwarding problems! nidputerguy Linux - Networking 4 01-31-2004 10:29 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 04:01 PM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration