Port forwarding question
Hi, folks.
Noob, question:
I want to allow a vendor to access a piece of equipment on our LAN (192.168.100.46) through port 4000 from outside via a server in our DMZ (www.xxx.yyy.zzz). While I should know how to do this, I'm not 100% sure. Can someone help?
Oh, and separately, how would I allow that access only through the vendor's ip address, if that were the way I decided to go?
Thanks.
Dimitri
Signature · 3 lines
This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
Quoted 7 lines · Dimitri Yioulos
Hi, folks.
Noob, question:
I want to allow a vendor to access a piece of equipment on our LAN (192.168.100.46) through port 4000 from outside via a server in our DMZ (www.xxx.yyy.zzz). While I should know how to do this, I'm not 100% sure. Can someone help?
In PREROUTING do a DNAT rule, in FORWARD allow traffic to 192.168.100.46.
Quoted 3 lines
Oh, and separately, how would I allow that access only through the vendor's ip address, if that were the way I decided to go?
Add -s $VENDOR_IP to both rules.
HTH,
M4
Greetings,
Quoted 3 lines · Dimitri Yioulos
Noob, question:
I want to allow a vendor to access a piece of equipment on our LAN (192.168.100.46) through port 4000 from outside via a server in our DMZ (www.xxx.yyy.zzz). While I should know how to do this, I'm not 100% sure. Can someone help?
DNAT.
for example:
iptables -t nat -A PREROUTING -d www.xxx.yyy.zzz -i eth1 -p tcp --dport 4000 -j DNAT --to 192.168.100.46
iptables -t filter -A INETIN -d 192.168.100.46 -p tcp --dport 4000 -j ACCEPT
Quoted 1 line
Oh, and separately, how would I allow that access only through the vendor's ip address, if that were the way I decided to go?
for example:
iptables -t nat -A PREROUTING -s 1.2.3.4 -d www.xxx.yyy.zzz -i eth1 -p tcp --dport 4000 -j DNAT --to 192.168.100.46
Regards,
--
Ritter
Quoted 2 lines · Mr Ritter
iptables -t filter -A INETIN -d 192.168.100.46 -p tcp --dport 4000 -j ACCEPT
Doh! INETIN is one of my tables, meant to say:
iptables -t filter -A FORWARD -d 192.168.100.46 -p tcp --dport 4000 -j ACCEPT
Quoted 10 lines · you
Greetings,
Quoted 6 lines · Dimitri Yioulos
Noob, question:
I want to allow a vendor to access a piece of equipment on our LAN (192.168.100.46) through port 4000 from outside via a server in our DMZ (www.xxx.yyy.zzz). While I should know how to do this, I'm not 100% sure. Can someone help?
Quoted 6 lines
DNAT.
for example:
iptables -t nat -A PREROUTING -d www.xxx.yyy.zzz -i eth1 -p tcp --dport 4000 -j
DNAT --to 192.168.100.46
eth1 being the DMZ iface?
Quoted 15 lines
iptables -t filter -A INETIN -d 192.168.100.46 -p tcp --dport 4000 -j ACCEPT
Quoted 2 lines
Oh, and separately, how would I allow that access only through the vendor's ip address, if that were the way I decided to go?
for example:
iptables -t nat -A PREROUTING -s 1.2.3.4 -d www.xxx.yyy.zzz -i eth1 -p tcp --dport 4000 -j DNAT --to 192.168.100.46Regards,
--
Ritter
Signature · 3 lines
This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
Quoted 18 lines · Dimitri Yioulos
Quoted 15 lines · you
Greetings,
Quoted 8 lines · Dimitri Yioulos
Noob, question:
I want to allow a vendor to access a piece of equipment on our LAN (192.168.100.46) through port 4000 from outside via a server in our DMZ (www.xxx.yyy.zzz). While I should know how to do this, I'm not 100% sure. Can someone help?
DNAT.
Quoted 10 lines
Quoted 6 lines
for example:
iptables -t nat -A PREROUTING -d www.xxx.yyy.zzz -i eth1 -p tcp --dport 4000 -j
DNAT --to 192.168.100.46eth1 being the DMZ iface?
No, your Internet interface.
This rule says: if destination is www.xxx.yyy.zzz and it comes in through eth1 and it's tcp and it's on port 4000, then DNAT to the internal server. Obviously, if the packet comes from the vendor, it must come from the Internet, so the interface in -i must be your Internet interface.
You could leave this out, but that opens up all kind of nastiness if you access this port on www.xxx.yyy.zzz from your DMZ (the return packets will go straight to your client in the DMZ, will not go through your firwall so will not be de-DNATted. Your client will get confused as it gets packets from somewhere it's not expecting them. In short, it will not work). You could replace that -i with "! -i $DMZ_IF", meaning if it comes in from any interface but the DMZ interface. Then you can access it from any interface (read your internal interface) other than your DMZ interface.
HTH,
M4
Quoted 39 lines · you
Quoted 11 lines · Dimitri Yioulos
Quoted 10 lines · you
Greetings,
Quoted 6 lines · Dimitri Yioulos
Noob, question:
I want to allow a vendor to access a piece of equipment on our LAN (192.168.100.46) through port 4000 from outside via a server in our DMZ (www.xxx.yyy.zzz). While I should know how to do this, I'm not 100% sure. Can someone help?
Quoted 8 lines
Quoted 6 lines
DNAT.
for example:
iptables -t nat -A PREROUTING -d www.xxx.yyy.zzz -i eth1 -p tcp --dport 4000 -j
DNAT --to 192.168.100.46eth1 being the DMZ iface?
No, your Internet interface.
This rule says: if destination is www.xxx.yyy.zzz and it comes in through eth1 and it's tcp and it's on port 4000, then DNAT to the internal server. Obviously, if the packet comes from the vendor, it must come from the Internet, so the interface in -i must be your Internet interface.
You could leave this out, but that opens up all kind of nastiness if you access this port on www.xxx.yyy.zzz from your DMZ (the return packets will go straight to your client in the DMZ, will not go through your firwall so will not be de-DNATted. Your client will get confused as it gets packets from somewhere it's not expecting them. In short, it will not work). You could replace that -i with "! -i $DMZ_IF", meaning if it comes in from any interface but the DMZ interface. Then you can access it from any interface (read your internal interface) other than your DMZ interface.
Quoted 2 lines
HTH,
M4
Stupid me. Of course it's the inet interface. And, I appreciate the explanation.
Many, many thanks to all for you help!
Dimitri
Signature · 3 lines
This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.