LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > CentOS
User Name
Password
CentOS This forum is for the discussion of CentOS Linux. Note: This forum does not have any official participation.

Notices


Reply
  Search this Thread
Old 09-06-2019, 08:10 PM   #1
herby1620
LQ Newbie
 
Registered: Mar 2004
Location: Sillicon Valley
Distribution: RedHat/Debian
Posts: 14

Rep: Reputation: 0
iptables attempt at nat & masquerade


I thought I had this figured out. I've got a box with two interfaces. One is "public" (not really, but for now it is), and the other is on a private net (172.16.4.0/24). All is OK, but if I try to setup nat through iptables, it doesn't work (yet). I'm trying to get a browser path (port 80) to translate. I can telnet to the object (server) machine's port 80 (it connects, but I don't do much else, a browser DOES work). I try to do a telnet to 'localhost' with port 80 and it doesn't translate. For reference my iptables save gets me:

>>>>>
[root@box1 ~]# iptables-save
# Generated by iptables-save v1.4.21 on Fri Sep 6 18:06:50 2019
*filter
:INPUT ACCEPT [37676:7078060]
:FORWARD ACCEPT [14:2180]
:OUTPUT ACCEPT [3363:465365]
COMMIT
# Completed on Fri Sep 6 18:06:50 2019
# Generated by iptables-save v1.4.21 on Fri Sep 6 18:06:50 2019
*nat
:PREROUTING ACCEPT [7814:1278912]
:INPUT ACCEPT [7066:1207801]
:OUTPUT ACCEPT [104:7746]
:POSTROUTING ACCEPT [13:716]
-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.16.4.101:80
-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.16.4.101:443
-A POSTROUTING -o eno1 -j MASQUERADE
COMMIT
# Completed on Fri Sep 6 18:06:50 2019
<<<<<

According to the documentation I read, this should be enough.

Actually I'm running on CentOS, but Fedora ought to be close enough.

Thanks.

Last edited by herby1620; 09-06-2019 at 08:11 PM. Reason: spelling
 
Old 09-07-2019, 10:21 PM   #2
Skaperen
Senior Member
 
Registered: May 2009
Location: WV, USA
Distribution: Xubuntu, Slackware, Amazon Linux
Posts: 1,903
Blog Entries: 21

Rep: Reputation: 125Reputation: 125
whatever Linux (or even BSD) you're running on, that's fine. don't worry about what's close. anyone who doesn't know what's close, you don't want their answers, anyway. just tell us what you are running, the version, and how you configure it and/or start it.

i recommend writing a script to do all the setup for each project. but that may require you to learn it if you don't already know.
 
Old 09-08-2019, 12:29 AM   #3
jsbjsb001
Senior Member
 
Registered: Mar 2009
Location: Earth? I would say I hope so but I'm not so sure about that... I could just be a figment of your imagination too.
Distribution: Currently OpenMandriva. Previously openSUSE, PCLinuxOS, CentOS, among others over the years.
Posts: 3,000

Rep: Reputation: 1555Reputation: 1555Reputation: 1555Reputation: 1555Reputation: 1555Reputation: 1555Reputation: 1555Reputation: 1555Reputation: 1555Reputation: 1555Reputation: 1555
Quote:
Originally Posted by herby1620 View Post
...
Actually I'm running on CentOS, but Fedora ought to be close enough.

Thanks.
While Fedora is in the RHEL ecosystem; CentOS isn't "bleeding edge" like Fedora is, so there are some differences between the two.

And shouldn't you be using SSH instead of telnet?
 
Old 09-08-2019, 07:28 AM   #4
michaelk
Moderator
 
Registered: Aug 2002
Posts: 18,934

Rep: Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859
I believe the OP is using telnet to test if forwarding port 80 traffic is working. Your assuming that

en01 is your WAN interface. Post your private interface.

You also need to configure IP packet forwarding (see /etc/sysctl.conf)

echo 1 > /proc/sys/net/ipv4/ip_forward

To really test your NAT configuration you need to configure your WAN interface and connect that to your home network instead of using localhost.

In addition to the iptables rules posted you also need a rule to forward traffic from your LAN back to the WAN interface. This will forward all traffic but you can limit it to just 80 and 443 after you see that it is working.

iptables --append FORWARD --in-interface LAN-interface -j ACCEPT

I've moved your thread to CentOS.
 
Old 09-09-2019, 11:21 AM   #5
herby1620
LQ Newbie
 
Registered: Mar 2004
Location: Sillicon Valley
Distribution: RedHat/Debian
Posts: 14

Original Poster
Rep: Reputation: 0
Some notes:

Yes, I was using telnet to port 80 to see if it worked. It is an easy way to do it.
Fedora/CentOS: As delivered, CentOS has a whole bunch of firewall stuff configured with its 'firewalld' program. I turned it off to make the process easier for (at least me!) to understand.
IP Packet forward is turned on:
>>>>>
[root@box1 ~]# cat /proc/sys/net/ipv4/ip_forward
1
<<<<<
I added to iptables APPEND command. No joy.
My dump of IPTables now reads:
>>>>>
[root@box1 ~]# iptables-save
# Generated by iptables-save v1.4.21 on Mon Sep 9 09:17:45 2019
*filter
:INPUT ACCEPT [5003:842941]
:FORWARD ACCEPT [7:420]
:OUTPUT ACCEPT [476:44526]
-A FORWARD -i ens1f0 -j ACCEPT
COMMIT
# Completed on Mon Sep 9 09:17:45 2019
# Generated by iptables-save v1.4.21 on Mon Sep 9 09:17:45 2019
*nat
:PREROUTING ACCEPT [479593:77403072]
:INPUT ACCEPT [414940:71870244]
:OUTPUT ACCEPT [4476:362328]
:POSTROUTING ACCEPT [14:1440]
-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.16.4.101:80
-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.16.4.101:443
-A POSTROUTING -o eno1 -j MASQUERADE
COMMIT
# Completed on Mon Sep 9 09:17:45 2019
<<<<<

Yes, I tried to access port 80 from another machine (not through localhost), and it times out.

For the curious: 'eno1' is the "wan" interface, and 'ens1f0' it the "lan" interface.

Any more ideas...

Thanks.
 
Old 09-09-2019, 12:04 PM   #6
herby1620
LQ Newbie
 
Registered: Mar 2004
Location: Sillicon Valley
Distribution: RedHat/Debian
Posts: 14

Original Poster
Rep: Reputation: 0
More trials and tribulations.

I did get it functional. The problem was in the object ("lan" machine) that had a different "default" route. It seems that the NAT box ("box1" in the examples above) had another "default" route. For some reason (I don't know right now) when a connection comes in over an interface, it will take the highest priority route (in this case a default route via another machine) instead of going back on the interface it came over.

outside --> box1 (nat) --> object. Return path
object --> other machine --> outside (which has no connectivity back to the "outside" machine) No Joy.

The solution was to change the line on the object machine (ifcfg-eth0)
DEFROUTE=yes
to:
DEFROUTE=no

And joy returns to the universe, both interfaces are functional, and NAT is functional.

Of course this raises the question of WHY doesn't the incoming packet from the xyz interface go back (by default) through the same interface. I'll leave that for another day, and I have a workable solution
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Iptables -t nat :MASQUERADE & DNAT Q rkbk Linux - Networking 3 04-19-2016 11:32 AM
OpenVPN - IPtables Issue: Cannot insert NAT MASQUERADE Holdont Linux - Networking 4 11-06-2015 02:45 AM
iptables masquerade nat portforwarding problem borborygmis Linux - Networking 5 08-14-2008 01:51 AM
Gotta love those &#1649;&#1649;&#1649;&#1649;&#1649;&#1649;&#1649;&# iLLuSionZ Linux - General 5 11-18-2003 07:14 AM
iptables - true nat AND masquerade rebuke Linux - Security 3 11-11-2003 02:02 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > CentOS

All times are GMT -5. The time now is 05:36 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration