2

I am trying to set up port forwarding on a linux box to a IIS webserver on my internal network. The web server sits on Windows 2003 Server.

My linux box has:

  • eth0 - Internet connection
  • eth1 - internal subnet (10.10.10.x)
  • eth2 - 2nd internal subnet (192.168.0.x) dhcp interface

My webserver is on the eth2 interface (192.168.0.6)

I am doing port forwarding for port 80 with no avail. I use the same set of rules to port forward to a different webserver and it works.

The webapplication is available on the internal network but not for external users.

iptables -t nat -A PREROUTING -p tcp -i eth0 -d $PUBLIC_IP --dport 80 -j DNAT --to 192.168.0.6:80
iptables -A FORWARD -p tcp -i eth0 -o eth2 -d 192.168.0.6 --dport 80 -m state --state NEW -j ACCEPT
iptables -A FORWARD -t filter -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -t filter -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Any Ideas?

2
  • Perhaps a silly question, but are you able to use curl/lynx to access your IIS server from your Linux box?
    – Zoredache
    Mar 12, 2010 at 4:18
  • Yes I can, i can hit the IIS server from linux, telnet to it, scan it for open ports and it shows everything
    – Simon
    Mar 12, 2010 at 20:39

4 Answers 4

1

Thanks everyone for their answers. The problem was found in the network configuration on the IIS server box. For some reason the default gateway wasn't configured... doh, Leason learned, don't trust what others tell you.

The rules i originally used do work.

0

maybe this doesn't fit your security model, but you may want to look into installing apache and using it's proxy module to route traffic to your IIS web server. On top of that, you can configure it to filter out all URLS except ones you strictly define, allowing your IIS installation to be more secure.

Apache Config file:

       <Proxy *>
               # deny most all requests
               Order deny,allow
               # allow from your internal network
               Allow from 192.168.x.x
       </Proxy>

       ProxyPass /yoursite http://internal_site/yoursite
2
  • I would recommend something lighter, like nginx, if there's only need for proxying and nothing more.
    – Mikael S
    Mar 11, 2010 at 23:54
  • I'll probably give this a try, i am running squid for my internal network on this linux box as a transparent proxy
    – Simon
    Mar 12, 2010 at 20:40
0

I don't think you need to use MASQUERADE. Try using SNAT instead.

0

I've always had luck with IIS and iptables using the following script:

$IPTABLES -P INPUT DROP $IPTABLES -P OUTPUT DROP $IPTABLES -P FORWARD DROP

$IPTABLES -t nat -A PREROUTING -j DNAT -p tcp -d $EXT_IP --dport $WWW_PORT --to-destination $WWW_IP $IPTABLES -t nat -A POSTROUTING -o $EXT_IFACE -j MASQUERADE

$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A INPUT -p all -i $LO_IFACE -j ACCEPT $IPTABLES -A INPUT -p all -s $LO_IP -j ACCEPT

$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -m state ! --state NEW -j DROP $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -p tcp -i $EXT_IFACE -s $ANY -d $WWW_IP --dport $WWW_PORT -j ACCEPT

$IPTABLES -A FORWARD -p all -i $INT_IFACE -j ACCEPT

You must log in to answer this question.