Port Forwarding
Hello.
I am running Debian(5.0.3), and have kernel version: 2.6.26-2-686.
And I have just installed the iptables v1.4.5.
After searching for help on debian and ubuntu forums, i didnt get any
response, so I'm writing here.
My network configuration is next:
eth0 is my internet interface and has dinamic ip(83.x.x.x).
eth1 is my intranet interface and has static ip(192.168.0.1).
The server machine(thise pc) shares internet with other machines.
At debian start iptables has the next config:
iptables -P FORWARD ACCEPT
iptables --table nat -A POSTROUTING --out-interface eth0 -j MASQUERADE
So now getting to the problem.
I wanted to configure port forwarding, and forward port 135 from Any
address that comes from eth0 (internet) to ip 192.168.0.200 and same
port(135).
I've tryied running the next:
iptables -F
iptables -t nat -F
iptables -P FORWARD ACCEPT
iptables --table nat -A POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --table nat -A PREROUTING --in-interface eth0 -j DNAT -p tcp --dport 135 --to 192.168.0.200:135
But the problem is that it is filtered (I check it with
nmap-online.com service).
Am i doing anything wrong or my kernel doesnt support it ?
Thanks in advance.
Have a good day.
Quoted 19 lines · On Sun, 2009-10-11 at 01:30 +0100, [email protected] wrote:
Hello.
I am running Debian(5.0.3), and have kernel version: 2.6.26-2-686. And I have just installed the iptables v1.4.5.
After searching for help on debian and ubuntu forums, i didnt get any response, so I'm writing here.
My network configuration is next:
eth0 is my internet interface and has dinamic ip(83.x.x.x). eth1 is my intranet interface and has static ip(192.168.0.1). The server machine(thise pc) shares internet with other machines. At debian start iptables has the next config:
iptables -P FORWARD ACCEPT
iptables --table nat -A POSTROUTING --out-interface eth0 -j MASQUERADE So now getting to the problem.
I wanted to configure port forwarding, and forward port 135 from Any address that comes from eth0 (internet) to ip 192.168.0.200 and same port(135).
I've tryied running the next:
iptables -F
iptables -t nat -F
Quoted 8 lines
iptables -P FORWARD ACCEPT
iptables --table nat -A POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --table nat -A PREROUTING --in-interface eth0 -j DNAT -p tcp --dport 135 --to 192.168.0.200:135
But the problem is that it is filtered (I check it with
nmap-online.com service).
Am i doing anything wrong or my kernel doesnt support it ?
Thanks in advance.
Have a good day.
<snip>
Have you checked to make sure the rule is actually loading (iptables -v -n -t nat -L PREROUTING)? I haven't checked it but I'm not sure if you need to place the argument to DNAT immediately after it for it to be understood, in other words:
iptables -t nat -A PREROUTING -i eth0 -p 6 --dport 135 -j DNAT --to-destination 192.168.0.200
I'd also be very careful about allowing Internet access to port 135; it is a very dangerous port. It also tends to then map the service to another port - how will you allow that port in?
I also usually do not set the FORWARD POLICY to ACCEPT. I set it to DROP and then explicitly allow any traffic from the outside world in. Hope this helps - John
Signature · 7 lines
John A. Sullivan III Open Source Development Corporation +1 207-985-7880 [email protected] http://www.spiritualoutreach.com Making Christianity intelligible to secular society
and dont forget to enable ip forwarding, or nothing will get through!
Quoted 33 lines · [email protected] wrote:
Hello.
I am running Debian(5.0.3), and have kernel version: 2.6.26-2-686.
And I have just installed the iptables v1.4.5.
After searching for help on debian and ubuntu forums, i didnt get any
response, so I'm writing here.
My network configuration is next:
eth0 is my internet interface and has dinamic ip(83.x.x.x).
eth1 is my intranet interface and has static ip(192.168.0.1).
The server machine(thise pc) shares internet with other machines.
At debian start iptables has the next config:
iptables -P FORWARD ACCEPT
iptables --table nat -A POSTROUTING --out-interface eth0 -j MASQUERADE
So now getting to the problem.
I wanted to configure port forwarding, and forward port 135 from Any
address that comes from eth0 (internet) to ip 192.168.0.200 and same
port(135).
I've tryied running the next:
iptables -F
iptables -t nat -F
iptables -P FORWARD ACCEPT
iptables --table nat -A POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --table nat -A PREROUTING --in-interface eth0 -j DNAT -p tcp --dport 135 --to 192.168.0.200:135
But the problem is that it is filtered (I check it with
nmap-online.com service).
Am i doing anything wrong or my kernel doesnt support it ?
Thanks in advance.
Have a good day.--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Hello,
Quoted 3 lines · [email protected] a écrit :
I wanted to configure port forwarding, and forward port 135 from Any address that comes from eth0 (internet) to ip 192.168.0.200 and same port(135).
[...]
Quoted 2 lines
But the problem is that it is filtered (I check it with
nmap-online.com service).
Did you check with a packet sniffer that these packets are actually received by the internet interface ? They may be filtered by either your ISP or the sender's ISP.