problems with nat

please check the attachment...

Thanks
Rahul

Since you are working on this anyway....

For a slightly more secure setup, you might want to consider:

R E I
T+--------+ X+--------+N
internet |---|R| router |---|T|firewall|T|---| intranet

               I+--------+    I+--------+I        
               P              P     |     P
				    |
				    DMZ IP
					\
					| HTTP, MAIL, SSH

This will protect your servers from other intranet users on the same subnet. (Also if you have 802.11 on your intranet...)

Maybe after doing this your problem will disappear simply by rethinking the ruleset.

-Ben.

You are right but I am trying to avoid doing that right now as i have invested a lot of time already into this system. Moreover, I am pretty sure there are people who have got iptables working with a setup like mine.

Regarding your DNAT/SNAT issues, I suggest reading through Oscar's tutorial at
http://iptables-tutorial.frozentux.net/chunkyhtml/targets.html#DNATTARGET
where he explores your situation pretty precisely, forwarding HTTP from EXTRA and INTRA, and making sure responses are directed properly. You also seem to have some problems in FORWARD, which I comment on below.

grep = and grep FORWARD give us:

RTRIP=router's ip
EXTIP=external eth ip
INTIP=internal eth ip
HTTPSERVER="http server ip"
MAILSERVER="mail server ip"
SSHSERVER="ssh server ip"
UNPRIVPORTS="1024:65535"
INTRA_DEV="internal eth"
EXTRA_DEV="external eth"
INTRA_IP="internal ip"
EXTRA_IP="external ip"
INTRA_LAN="internal lan"
PUBLIC_IP="public ip of the router"

## FORWARD-Chain ## (everything that passes the firewall) $IPTABLES -A FORWARD -m state --state INVALID -j LOG_INVALID $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -p tcp -j CHECK_BAD_FLAG
$IPTABLES -A FORWARD -o $EXTRA_DEV -j SMB
$IPTABLES -A FORWARD -o $EXTRA_DEV -p tcp -i $INTRA_DEV -d $UNIVERSE -j ACCEPT $IPTABLES -A FORWARD -o $EXTRA_DEV -p udp -i $INTRA_DEV -d $UNIVERSE -j ACCEPT $IPTABLES -A FORWARD -o $EXTRA_DEV -s $HTTPSERVER -p tcp --sport 80 -j ACCEPT $IPTABLES -A FORWARD -o $EXTRA_DEV -s $HTTPSERVER -p udp --sport 80 -j ACCEPT $IPTABLES -A FORWARD -o $EXTRA_DEV -s $HTTPSERVER -p tcp --sport $UNPRIVPORTS -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $HTTPSERVER -p udp --sport $UNPRIVPORTS -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport 25 -j ACCEPT $IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport 110 -j ACCEPT $IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport 109 -j ACCEPT $IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport 143 -j ACCEPT $IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport 81 -j ACCEPT $IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p udp --sport 81 -j ACCEPT $IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport $UNPRIVPORTS -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p udp --sport $UNPRIVPORTS -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport 389 -j ACCEPT $IPTABLES -A FORWARD -o $EXTRA_DEV -s $SSHSERVER -p tcp --sport 82 -j ACCEPT $IPTABLES -A FORWARD -o $EXTRA_DEV -s $SSHSERVER -p tcp --sport 83 -j ACCEPT $IPTABLES -A FORWARD -o $EXTRA_DEV -s $SSHSERVER -p tcp --sport 22 -j ACCEPT $IPTABLES -A FORWARD -i $INTRA_DEV -o $EXTRA_DEV -s $INTRA_LAN -p tcp --sport $UNPRIVPORTS -j ACCEPT
$IPTABLES -A FORWARD -i $INTRA_DEV -o $EXTRA_DEV -s $INTRA_LAN -p udp --sport $UNPRIVPORTS -j ACCEPT
$IPTABLES -A FORWARD -i $INTRA_DEV -o $EXTRA_DEV -s $INTRA_LAN -p icmp -j ACCEPT
$IPTABLES -A FORWARD -i $EXTRA_DEV -p tcp -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i $EXTRA_DEV -p udp -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i $EXTRA_DEV -p tcp -m state --state RELATED -j ACCEPT $IPTABLES -A FORWARD -i $EXTRA_DEV -p udp -m state --state RELATED -j ACCEPT $IPTABLES -A FORWARD -i $EXTRA_DEV -p icmp -m state --state RELATED -j ACCEPT $IPTABLES -A FORWARD -p tcp --dport 80 -d $HTTPSERVER -j ACCEPT $IPTABLES -A FORWARD -p udp --dport 80 -d $HTTPSERVER -j ACCEPT $IPTABLES -A FORWARD -p tcp --dport 80 -d $EXTRA_IP -j ACCEPT $IPTABLES -A FORWARD -p udp --dport 80 -d $EXTRA_IP -j ACCEPT $IPTABLES -A FORWARD -p tcp --dport 81 -d $MAILSERVER -j ACCEPT $IPTABLES -A FORWARD -p udp --dport 81 -d $MAILSERVER -j ACCEPT $IPTABLES -A FORWARD -p tcp --dport 81 -d $EXTRA_IP -j ACCEPT $IPTABLES -A FORWARD -p udp --dport 81 -d $EXTRA_IP -j ACCEPT $IPTABLES -A FORWARD -p tcp --dport 22 -d $SSHSERVER -j ACCEPT $IPTABLES -A FORWARD -p tcp --dport 82 -d $SSHSERVER -j ACCEPT $IPTABLES -A FORWARD -p udp --dport 82 -d $SSHSERVER -j ACCEPT $IPTABLES -A FORWARD -p tcp --dport 83 -d $SSHSERVER -j ACCEPT $IPTABLES -A FORWARD -p udp --dport 83 -d $SSHSERVER -j ACCEPT $IPTABLES -A FORWARD -p tcp --dport 82 -d $EXTRA_IP -j ACCEPT $IPTABLES -A FORWARD -p udp --dport 82 -d $EXTRA_IP -j ACCEPT $IPTABLES -A FORWARD -p tcp --dport 83 -d $EXTRA_IP -j ACCEPT $IPTABLES -A FORWARD -p udp --dport 83 -d $EXTRA_IP -j ACCEPT $IPTABLES -A FORWARD -p tcp --dport 22 -d $EXTRA_IP -j ACCEPT $IPTABLES -A FORWARD -j LOG_DROP
## Port-Forwarding (--> Also see chain FORWARD)

Where do you define $UNIVERSE? You are referring here to user-defined chains that are not defined, like CHECK_BAD_FLAG and SMB. I assume you DO define them, just didn't include them? With ALL TCP going through CHECK_BAD_FLAG (except EST/REL, caught just before) the contents of that chain could be rather important in trying to find problems. The same for SMB where everything outbound from your LAN to the internet is filtered...

Your second FORWARD rule allows all EST/REL traffic through, regardless of source or destination. This is normally OK, but makes the five state rules further down rather pointless. (they could also be condensed, unless you are using them as counters, but aren't ever matched as it stands) But you don't follow up by allowing new HTTP or DNS traffic from the LAN to your servers. -o $EXTRA_DEV -i $INTRA_DEV should allow local machines to browse the internet, but doesn't address local machines trying to connect to your servers. -p tcp --dport 80 -i $INTRA_DEV -d $HTTPSERVER, for example, should match them.

Also, I'd suggest that rather than test for "--sport $UNPRIVPORTS" you test for allowed destination ports only. IE, for HTTP forwarding, use "--dport 80", etc. Otherwise you let ANY traffic through, as long as it's source port is over 1024.

j