DNAT
Hi,
I want to access my internal machine from outside. But I am unable to do so. I tried,
# iptables -t nat -I PREROUTING -d <my_ext_ip> -p tcp --dport 8081 -j DNAT --to-destination 192.168.0.16:80 # iptables -I INPUT -p tcp --dport 8081 -j ACCEPT # iptables -I FORWARD -s 192.168.0.16 -j ACCEPT
I know these are very crude but they are simple to start with. Also, once I get one more public IP from my ISP, I will NAT it to the internal machine.
Can anyone give pointers on this and above to why it is not working? If this is right, is it possible that my ISP might be blocking traffic from outside to ports other than the few.
With warm regards,
-Payal
Quoted 7 lines · Payal Rathod
Hi,
I want to access my internal machine from outside. But I am unable to do so. I tried,# iptables -t nat -I PREROUTING -d <my_ext_ip> -p tcp --dport 8081 -j DNAT --to-destination 192.168.0.16:80 # iptables -I INPUT -p tcp --dport 8081 -j ACCEPT
the one above is useless because the INPUT chain in this case is not traversed.
Quoted 3 lines
# iptables -I FORWARD -s 192.168.0.16 -j ACCEPT
This one is the one u need ... but u have to make the check on destination and not on source so #iptables -I FORWARD -d 192.168.0.16 -j ACCEPT
Quoted 5 lines
With warm regards,
-Payal
bye :)
Signature · 8 lines
---------------------------------------
#######################################
"Linux, the choice of a GNU generation"
==Micro$oft - just say NO==
#######################################
---------------------------------------Quoted 5 lines · Payal Rathod
Hi,
I want to access my internal machine from outside. But I am unable to do so. I tried,# iptables -t nat -I PREROUTING -d <my_ext_ip> -p tcp --dport 8081 -j DNAT --to-destination 192.168.0.16:80
that looks ok...keep in mind you'll need to go to:
http://<my_ext_ip>:8081 to hit the server from the outside
Quoted 1 line
# iptables -I INPUT -p tcp --dport 8081 -j ACCEPT
nope--try:
iptables -A FORWARD -p tcp -d 192.168.0.16 --dport 80 -j ACCEPT
once PREROUTING is traversed--the packet is forever changed from the perspective of all remaining chains.
Quoted 1 line
# iptables -I FORWARD -s 192.168.0.16 -j ACCEPT
i guess the point of that is to allow the replies back? ok, i guess...
-j
Signature · 1 line
Jason Opperisano <[email protected]>