DNAT not working
Dear List!
I have the following setup:
eth0 (WAN, with multiple alias IPs), eth1 (LAN1), eth2 (LAN2), eth3 (LAN3)
I would like to setup DNAT, in order to achieve the following:
packets coming from eth0 to a certain IP and tcp port get NATed to an IP and port for a machine on one of the LAN subnets
I have read the relevant HOWTO and made the following setup:
# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface aaa.bbb.ccc.ddd 0.0.0.0 255.255.255.248 U 0 0 0 eth0 192.168.5.0 0.0.0.0 255.255.255.0 U 0 0 0 eth3 192.168.4.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2 192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 0.0.0.0 aaa.bbb.ccc.eee 0.0.0.0 UG 0 0 0 eth0 # cat /var/lib/iptables/testing # Generated by iptables-save v1.3.5 on Fri Dec 22 14:23:36 2006 *mangle :PREROUTING ACCEPT [1804:164934] :INPUT ACCEPT [1576:145710] :FORWARD ACCEPT [208:12864] :OUTPUT ACCEPT [988:111965] :POSTROUTING ACCEPT [1239:130436] COMMIT # Completed on Fri Dec 22 14:23:36 2006 # Generated by iptables-save v1.3.5 on Fri Dec 22 14:23:36 2006 *nat :PREROUTING ACCEPT [58:10171] :POSTROUTING ACCEPT [13:1459] :OUTPUT ACCEPT [13:1459] -A PREROUTING -d aaa.bbb.ccc.fff -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.3.1 -A PREROUTING -j LOG --log-prefix "PREROUTING: " --log-level 7 COMMIT # Completed on Fri Dec 22 14:23:36 2006 # Generated by iptables-save v1.3.5 on Fri Dec 22 14:23:36 2006 *filter :INPUT ACCEPT [1576:145710] :FORWARD ACCEPT [208:12864] :OUTPUT ACCEPT [988:111965] -A FORWARD -d 192.168.3.1 -i eth0 -o eth1 -p tcp -m tcp --dport 25 -j ACCEPT -A FORWARD -j LOG --log-prefix "FORWARD: " --log-level 7 COMMIT # Completed on Fri Dec 22 14:23:36 2006
If I telnet 192.168.3.1 25 on the firewall, an SMTP session starts. If I telnet from outside (coming on eth0), it waits until timeout. I just can't figure out why it is not working. At last I removed all the IP aliases, and it didn't work that way either. There is nothing relevant in /var/log/syslog. I have 1 in /proc/sys/net/ipv4/ip_forward.
Please help. Thanks in advance.
Yours sincerely,
Fülöp Balázs
Quoted 9 lines · Balazs Fulop
# Generated by iptables-save v1.3.5 on Fri Dec 22 14:23:36 2006 *nat
:PREROUTING ACCEPT [58:10171]
:POSTROUTING ACCEPT [13:1459]
:OUTPUT ACCEPT [13:1459]
-A PREROUTING -d aaa.bbb.ccc.fff -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.3.1
-A PREROUTING -j LOG --log-prefix "PREROUTING: " --log-level 7 COMMIT
<snip>
Quoted 1 line
If I telnet 192.168.3.1 25 on the firewall, an SMTP session starts. If I telnet from outside (coming on eth0), it waits until timeout. I just can't figure out why it is not working. At last I removed all the IP aliases, and it didn't work that way either. There is nothing relevant in
/var/log/syslog. I have 1 in/proc/sys/net/ipv4/ip_forward.
It does not look like you are SNATing / MASQUERADing your traffic back out to the internet.
Grant. . . .
Hello,
Quoted 3 lines · Grant Taylor
Quoted 1 line · Balazs Fulop
If I telnet 192.168.3.1 25 on the firewall, an SMTP session starts. If I telnet from outside (coming on eth0), it waits until timeout.
I am not surprised that telnet to a private address from the outside fails. ;-)
Quoted 1 line
It does not look like you are SNATing / MASQUERADing your traffic back out to the internet.
You do not need to SNAT/MASQUERADE return traffic. The NAT code does it implicitly. However, the target host must have a (default) route back to the outside via the NATing gateway.
Hello,
Quoted 2 lines
You do not need to SNAT/MASQUERADE return traffic. The NAT code does it implicitly. However, the target host must have a (default) route back to the outside via the NATing gateway.
The default gateway of the NATed machine was not the NATing gateway. The problem is now solved. Thank you very much.
Yours sincerely,
Fülöp Balázs