Fedora Core 2. Port Forwarding Problems
Hello all.
I had to upgrade my border machine because previous installation had failed for some reason. Any attempt to modprobe any netfilter related modules returned "Floating point exception"
I've installed fedora core 2 and tried to reuse my old settings i retained from redhat9 system.
Masqeurading works fine, but when i try to do port forwarding like this
iptables -t nat -A PREROUTING -p tcp -d <domainname.com> --dport 80 -j DNAT --to 192.168.20.40:80 rule adds itself fine, but port 80 is not accessible from outside.
when i try to connect from outside it doesn't say connection refused, it dies after a timeout. /proc/net/ip_conntrack doesn't show any presence of connection, I tried to send it to -j LOG & ULOG but both end up empty.
I have to restore the firewall asap. Help me figure this one out. (I still have the option to rollback to rh9)
p.s.
sys.net.ipv4.ip_forwarding is 1
Quoted 7 lines · Василий Свиридов
I've installed fedora core 2 and tried to reuse my old settings i retained from redhat9 system.
Masqeurading works fine, but when i try to do port forwarding like this iptables -t nat -A PREROUTING -p tcp -d <domainname.com> --dport 80 -j DNAT --to 192.168.20.40:80
rule adds itself fine, but port 80 is not accessible from outside.
Are you sure about the resolving of domainname.com? What does the rule get
added as?
Quoted 4 lines
when i try to connect from outside it doesn't say connection refused, it dies after a timeout.
/proc/net/ip_conntrackdoesn't show any presence of connection, I tried to send it to -j LOG & ULOG but both end up empty.
Please show us your ruleset. We would like to see:
- what IP address the above PREROUTING rule gets installed with
- the corresponding FORWARD rule for the packets
- an appropriate reply packet rule
- how you have been LOGging packets for testing
I suggest the output of "iptables -L -nvx; iptables -L -t nat -nvx" and if appropriate also "iptables -L -t mangle -nvx" is a good format for us to understand where you're starting from.
Regards,
Antony.
Signature · 10 lines
In science, one tries to tell people
in such a way as to be understood by everyone
something that no-one ever knew before.
In poetry, it is the exact opposite.
- Paul Dirac
Please reply to the list;
please don't CC me.Quoted 7 lines · Antony Stone
Quoted 3 lines · Василий Свиридов
I've installed fedora core 2 and tried to reuse my old settings i retained from redhat9 system.
Quoted 10 lines
Quoted 6 lines
Masqeurading works fine, but when i try to do port forwarding like this iptables -t nat -A PREROUTING -p tcp -d <domainname.com> --dport 80 -j DNAT --to 192.168.20.40:80
rule adds itself fine, but port 80 is not accessible from outside.Are you sure about the resolving of domainname.com? What does the rule get added as?
It simply resolves the address and adds the IP.
Quoted 15 lines
Quoted 8 lines
when i try to connect from outside it doesn't say connection refused, it dies after a timeout.
/proc/net/ip_conntrackdoesn't show any presence of connection, I tried to send it to -j LOG & ULOG but both end up empty.Please show us your ruleset. We would like to see:
- what IP address the above PREROUTING rule gets installed with
- the corresponding FORWARD rule for the packets
- an appropriate reply packet rule
- how you have been LOGging packets for testing
Quoted 8 lines
I suggest the output of "iptables -L -nvx; iptables -L -t nat -nvx" and if appropriate also "iptables -L -t mangle -nvx" is a good format for us to understand where you're starting from.
Regards,
Antony.
iptables -L -nvx doesn't contain any rules yet.
[root@border root]# iptables -L -t nat -nvx
Chain PREROUTING (policy ACCEPT 5913 packets, 353422 bytes)
pkts bytes target prot opt in out
source destination
8 408 DNAT tcp -- * *
0.0.0.0/0 207.6.196.64 tcp dpt:80 to:192.168.20.40:80
Chain POSTROUTING (policy ACCEPT 4 packets, 244 bytes)
pkts bytes target prot opt in out
source destination
744 42337 MASQUERADE all -- * eth0
0.0.0.0/0 0.0.0.0/0
11 588 SNAT tcp -- * *
0.0.0.0/0 192.168.20.40 ctstate DNAT tcp dpt:80 to:207.6.196.64
Chain OUTPUT (policy ACCEPT 123 packets, 7641 bytes)
pkts bytes target prot opt in out
source destination
3 180 DNAT tcp -- * *
0.0.0.0/0 207.6.196.64 tcp dpt:80 to:192.168.20.40:80
This kind of configuration worked just fine on RH9. But it wasn't working on it when I've tried to install kernel 2.6.6.
Thanks.
Re: Fedora Core 2. Port Forwarding Problems (nfcan: addressed to exclusive sender for this address)
Quoted 11 lines · On 2004.07.24 16:12, "=?UTF-8?B?0JLQsNGB0LjQu9C40Lkg0KHQstC40YDQuNC00L7Qsg==?=…
Quoted 11 lines · Василий Свиридов
Quoted 8 lines
I've installed fedora core 2 and tried to reuse my old settings i retained from redhat9 system.
Masqeurading works fine, but when i try to do port forwarding like this iptables -t nat -A PREROUTING -p tcp -d <domainname.com> --dport 80 -j DNAT --to 192.168.20.40:80
rule adds itself fine, but port 80 is not accessible from outside.
Quoted 7 lines
Quoted 6 lines
Quoted 5 lines
when i try to connect from outside it doesn't say connection refused, it dies after a timeout.
/proc/net/ip_conntrackdoesn't show any presence of connection, I tried to send it to -j LOG & ULOG but both end up empty.iptables -L -nvx doesn't contain any rules yet.
Vasily, you have not told us what the default polity for the filter table is. In the absence of any rules, the default policy controls the behavior. Might this policy be DROP?
Perhaps the default policy has changed between versions.
Hope this helps.
Jim