Port forwarding on host interface

Hi all,

I would like to redirect an external port to another port on the same machine. I read on some documents that the kernel doesn't allow DNAT to 127.0.0.1 so I ended up with following setup:

let's say I want to redirect 59000 port on my 1.2.3.4 public IP to 5900 port on the same public IP *but a direct connection to 5900 port on the public IP* is forbidden. At this time my packets are marked for iproute2 (2 ISP), mark 201 (isp1) or 202 (Isp2).

Has someone a tip for me? Is it true that forwarding to 127.0.0.1 can't be done?

Thanks for any hint.

Daniel Huhardeaux       _____ ____ ____ _____ _____ _
enum   +33 368 460 088 (_  __) _  ) _  (_  __) _  _(_)  +48 222 472 472
iaxtel  1-700-849-6983  / / / // / // / / / / /_/ / /  GIZMO,SKYPE,GTALK
sip/iax:callto 101@sip./_/ ( ___( ___/ /_/ (_/ (_/_/.net   tootaiNET

Hello,

take a look at the REDIRECT target.

Regards

Mart

REDIRECT is your friend.

This is not exactly right. NAT allows any address you like, but the kernel routing prohibits packets with an address in the loopback range on a non-loopback interface, regardless of NAT. It might be worth mentionning that the routing decision occurs after the PREROUTING chain and does not know about the original destination address. However DNAT to 127.x.y.z works fine in the OUTPUT chain because the packets are rerouted through the loopback interface and don't leave the host.

You can drop packets to port 5900 in the mangle table before the nat table. Or you can mark them in the mangle table and drop or reject them later in the filter table (preferred).

If you mean IP forwarding, yes, for the same reason as above because IP forwarding involves non-loopback interfaces. Note that what you want to do is not IP forwarding.

If you mean what is commonly called "port forwarding" which is a form of destination NAT, you can use loopback addresses as long as packets don't leave or enter the host. As I wrote above, DNAT to 127.x.y.z works fine in the OUTPUT chain.

Pascal Hambourg a écrit :

Good day,

Thanks to Mart and you I got it work :-)

My rules are:

           [snip]

           [ -z $IP   ] && 

IP=$EXTERNAL_MAIN_IP

           [ -z $PORT ] && 

PORT=$EXT_PORT

$IPTABLES -t mangle -A PREROUTING -p tcp -i
$EXTERNAL_MAIN_DEVICE -d $EXTERNAL_MAIN_NET --dport $PORT -j
DROP

if [ "$IP" == "$EXTERNAL_MAIN_IP" ]; then
$IPTABLES -t nat -A PREROUTING -p tcp -i
$EXTERNAL_MAIN_DEVICE -d $IP --dport $EXT_PORT -j
REDIRECT --to-port $PORT
$IPTABLES -A INPUT -p tcp -i
$EXTERNAL_MAIN_DEVICE -d $IP --dport $PORT -j
ACCEPT
else
# To inhibed when IP is 127.0.0.1
$IPTABLES -t nat -A PREROUTING -p tcp -i
$EXTERNAL_MAIN_DEVICE -d $EXTERNAL_MAIN_NET --dport $EXT_PORT -j
DNAT --to $IP:$PORT
$IPTABLES -A FORWARD -p tcp -m
tcp --dport $PORT -j
ACCEPT
# Test for redirection to localhost, to activate when IP
is 127.0.0.1
#$IPTABLES -t nat -A OUTPUT -p tcp -o
$EXTERNAL_MAIN_DEVICE -d $IP --dport $EXT_PORT -j
DNAT --to $IP:$PORT
#$IPTABLES -A [INPUT|FORWARD] -p tcp -m
tcp --dport $PORT -j
ACCEPT
fi

This is working fine when $IP is the public one or the Intranet one. But when I put the localhost 127.0.0.1 and activate the right stuff, it's not working (tried with both INPUT and FORWARD). Telnet to the EXT_PORT shows try to connect ... From the host, telnet localhost $PORT is working.

Concerning mark of packets, as I told in my original mail, they are already marked in the mangle table, prerouting rule for my 2 ISP. I tried to find a solution with save/restore but problem is that mangle can't use user define target, so how to restore original mark AND accept the packet?

Thanks to you and Mart for your time

Daniel Huhardeaux       _____ ____ ____ _____ _____ _
enum   +33 368 460 088 (_  __) _  ) _  (_  __) _  _(_)  +48 222 472 472
iaxtel  1-700-849-6983  / / / // / // / / / / /_/ / /  GIZMO,SKYPE,GTALK
sip/iax:callto 101@sip./_/ ( ___( ___/ /_/ (_/ (_/_/.net   tootaiNET