Skip to contentSkip to conversation

Port Forwarding with iptables

DISCUSSION Wilson Mak 5 participants 7 messages Aug 19, 2004 – Aug 23, 2004

lore
Share & tools
lore

Wilson Mak

author
#0 lore raw

Hi all,

I like to do the portforwarding with iptables(forward web traffic of an alias IP - <ext ip> to internal web server). Here is what I have:

iptables -t nat -A PREROUTING -i eth0 -d <ext ip> -p tcp --dport 80 -j DNAT --to 10.1.0.12:80
iptables -A INPUT -p tcp -i eth0 -d <ext ip> --dport 80 -m state --state NEW -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 -o eth1 -d <ext ip> --dport 80 -m state --state NEW -j ACCEPT

However, it keep droping the packets when getting to the NAT box.

Logs
====
(With iptables -A FORWARD -d 10.1.0.12 -j LOG; iptable -A FORWARD -j DROP)

kernel: IN=eth0 OUT=eth1 SRC=202.xxx.122.xxx DST=10.1.0.12 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=6491 DF PROTO=TCP SPT=4023 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0

Any clues? Did I miss something here?

Thanks,
Wilson

#1 lore raw
Quoted 11 lines · Wilson Mak

Hi all,

I like to do the portforwarding with iptables(forward web traffic of an alias IP - <ext ip> to internal web server). Here is what I have:

iptables -t nat -A PREROUTING -i eth0 -d <ext ip> -p tcp --dport 80 -j DNAT --to 10.1.0.12:80
iptables -A INPUT -p tcp -i eth0 -d <ext ip> --dport 80 -m state --state NEW -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 -o eth1 -d <ext ip> --dport 80 -m state --state NEW -j ACCEPT

Take a look at -d param

Quoted 9 lines

However, it keep droping the packets when getting to the NAT box.

Logs
====
(With iptables -A FORWARD -d 10.1.0.12 -j LOG; iptable -A FORWARD -j DROP)

kernel: IN=eth0 OUT=eth1 SRC=202.xxx.122.xxx DST=10.1.0.12 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=6491 DF PROTO=TCP SPT=4023 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0

Now look at DST,

Q: Do they match? :)

Quoted 6 lines

Any clues? Did I miss something here?

Thanks,
Wilson

Signature · 1 line
Bla bla
#2 lore raw
In reply to Wilson Mak
Quoted 18 lines · Wilson Mak

Hi all,

I like to do the portforwarding with iptables(forward web traffic of an alias IP - <ext ip> to internal web server). Here is what I have:

iptables -t nat -A PREROUTING -i eth0 -d <ext ip> -p tcp --dport 80 -j DNAT --to 10.1.0.12:80
iptables -A INPUT -p tcp -i eth0 -d <ext ip> --dport 80 -m state --state NEW -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 -o eth1 -d <ext ip> --dport 80 -m state --state NEW -j ACCEPT

However, it keep droping the packets when getting to the NAT box.

Logs
====
(With iptables -A FORWARD -d 10.1.0.12 -j LOG; iptable -A FORWARD -j DROP)

Quoted 5 lines

kernel: IN=eth0 OUT=eth1 SRC=202.xxx.122.xxx DST=10.1.0.12 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=6491 DF PROTO=TCP SPT=4023 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0

Any clues? Did I miss something here?

( caveat, this is a quick email during a lunch break at work, so it's all "best guess" )

The rules in the PREROUTING table are executed before those in the FORWARD table, so the packet has a destination of 10.1.0.12 when it hits the FORWARD table. So your third line should be

iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 10.1.0.12 --dport 80 -m state --state NEW -j ACCEPT

Let me know how you get on :)

Signature · 1 line
"I think a church with a lightning rod shows a decided lack of confidence"
author
#3 lore raw
Quoted 31 lines · Nick Drage
Quoted 17 lines · Wilson Mak

Hi all,

I like to do the portforwarding with iptables(forward web traffic of an alias IP - <ext ip> to internal web server). Here is what I have:

iptables -t nat -A PREROUTING -i eth0 -d <ext ip> -p tcp --dport 80 -j DNAT --to 10.1.0.12:80
iptables -A INPUT -p tcp -i eth0 -d <ext ip> --dport 80 -m state --state NEW -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 -o eth1 -d <ext ip> --dport 80 -m state --state NEW -j ACCEPT

However, it keep droping the packets when getting to the NAT box.

Logs
====
(With iptables -A FORWARD -d 10.1.0.12 -j LOG; iptable -A FORWARD -j DROP)

Quoted 7 lines

kernel: IN=eth0 OUT=eth1 SRC=202.xxx.122.xxx DST=10.1.0.12 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=6491 DF PROTO=TCP SPT=4023 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0

Any clues? Did I miss something here?

( caveat, this is a quick email during a lunch break at work, so it's all "best guess" )

Quoted 12 lines

The rules in the PREROUTING table are executed before those in the FORWARD table, so the packet has a destination of 10.1.0.12 when it hits the FORWARD table. So your third line should be

iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 10.1.0.12 --dport 80 -m state --state NEW -j ACCEPT

Let me know how you get on :)

Thanks for all who help on this issue. I mis-type the rule here. Yes you guys are right, the rule should be: -d 10.1.0.12. But still it doesn't work. Do I need to enable something in the kernel when using Port-Forwarding?

Here are what I have now
===================
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

iptables -t nat -A PREROUTING -i eth0 -d <ext ip - an alias ip> -p tcp --dport 80 -j DNAT --to 10.1.0.12:80 iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 10.1.0.12 --dport 80 -m state --state NEW -j ACCEPT iptables -A FORWARD -t filter -i eth1 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -t filter -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Many thanks,
Wilson

#4 lore raw
Quoted 1 line · Wilson Mak

Nick Drage wrote:

Excuse the short answer...

Quoted 4 lines

Thanks for all who help on this issue. I mis-type the rule here. Yes you guys are right, the rule should be: -d 10.1.0.12. But still it doesn't work. Do I need to enable something in the kernel when using Port-Forwarding?

Try:

echo 1 > /proc/sys/net/ipv4/ip_forward

If you google for that you should find an explanation :)

Signature · 1 line
"I think a church with a lightning rod shows a decided lack of confidence"
author
#5 lore raw
Quoted 15 lines · Nick Drage
Quoted 3 lines · Wilson Mak

Nick Drage wrote:

Excuse the short answer...

Quoted 3 lines

Thanks for all who help on this issue. I mis-type the rule here. Yes you guys are right, the rule should be: -d 10.1.0.12. But still it doesn't work. Do I need to enable something in the kernel when using Port-Forwarding?

Quoted 8 lines

Try:

echo 1 > /proc/sys/net/ipv4/ip_forward

If you google for that you should find an explanation :)

Yap! I did set this bit to 1. Any other stuffs I missed? That's absolutely weird. It used to work perfectly with ipchains plus ipmasqadm. Actually, the packets did forward to the internal server ( I capture the packets with ethereal), but looks like the response packets can't get through the NAT box.

Thanks,
Wilson

#6 lore raw
In reply to Wilson Mak

Hello Wilson,

Quoted 2 lines

iptables -t nat -A PREROUTING -i eth0 -d <ext ip> -p tcp --dport 80 -j DNAT --to 10.1.0.12:80

That's ok.

Quoted 2 lines

iptables -A INPUT -p tcp -i eth0 -d <ext ip> --dport 80 -m state --state NEW -j ACCEPT

This rule is only necessary if you have a webserver running on you
firewall.

Quoted 2 lines

iptables -A FORWARD -p tcp -i eth0 -o eth1 -d <ext ip> --dport 80 -m state --state NEW -j ACCEPT

Ops. You made a mistake. You have added a rule which changes the
destination IP address to your internal webserver, remember? Your forward rule must specify the internal address as destination. iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 10.1.0.12/32 --dport 80 --syn -j ACCEPT

Regards,

Signature · 5 lines
--
Alejandro Flores
http://www.triforsec.com.br/
http://www.defenselayer.com/
http://www.nabucodonosor.com/