0

We are using Stunnel. But want to replace it is with an iptables entry if possible.

192.168.123.122:7300 need to be forwarded to 192.168.123.188:7300. So in iptables I set these two entries:

[root@dev ~]# iptables -t nat -A PREROUTING -p tcp --dport 7300 -j DNAT --to-destination 192.168.123.188:7300
[root@dev ~]# iptables -A FORWARD -m state -p tcp -d 192.168.123.188 --dport 7300 --state NEW,ESTABLISHED,RELATED -j ACCEPT

But it isn't working.

I did check that /proc/sys/net/ipv4/conf/eth0/forwarding has the value "1" inside.

Any tips or hints?

thanks, Patrick

Improve this question
1
  • I'm guessing you're already aware that stunnel doesn't just re-route traffic, it wraps it in SSL - and iptables doesn't
    – symcbean
    Nov 25, 2010 at 10:09

2 Answers 2

Reset to default
0

To enable IP forwarding, I usually change the value of /proc/sys/net/ipv4/ip_forward to 1.

To make it permanent, I uncomment the line: net.ipv4.ip_forward=1 in /etc/sysctl.conf.

You did not mention from where you are making your request.

Also, you need to be careful about choosing the correct chains (INPUT, FORWARD, PREROUTING, etc.). The INPUT chain is used to process the packets destined to the firewall itself. The OUTPUT chain is used for the packets originated from the firewall host. The FORWARD is used for those packets passing through the firewall.

At the end, tcpdump is your friend when you are not sure which firewall rule is not working. You can trace the traffic coming and going out of your firewall.

Improve this answer
1
  • [root@dev ~]# cat /proc/sys/net/ipv4/ip_forward 1 that is there also yes
    – Patrick van Hout
    Nov 25, 2010 at 8:29
0

have you add Masquerade ?

iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .