Forwarding ports with iptables

Question

Edit: resolved using info I found here iptables port forwarding on debian

I'm trying to set up svn on my existing web server, and for some reason the same technique I use for forwarding to web servers through my router isn't working for the different port for svn. I wrote the following simple shell script to add a server

#!/bin/bash
#!/bin/sh

ROOT_UID=0

if [ $UID -ne $ROOT_UID ]
then
    echo "You must be root."
    exit 87
else
    echo "Adding FORWARD entry..."
    iptables -I FORWARD 5 -p tcp -i eth1 -d $1 --dport $3 -j ACCEPT
    echo "Adding PREROUTING entries..."
    iptables -t nat -I PREROUTING 1 -p tcp -i eth1 --dport $3 -j DNAT --to $1:$3
    iptables -t nat -I PREROUTING 2 -p tcp -i ath0 -d $2 -j DNAT --to $1:$3
    iptables -t nat -I PREROUTING 3 -p tcp -i eth2 -d $2 -j DNAT --to $1:$3
    echo "Adding POSTROUTING entry..."
    iptables -t nat -A POSTROUTING -p tcp -o eth2 -d $1 --dport $3 -j MASQUERADE
    echo "Done"
    exit 0
fi

Where $1 is the internal IP of the server, $2 is the external host name, and $3 is the port. I've also tried opening the port on INPUT as a port scan reveals that the port I'm trying to used is closed after running the above script.

Any help would be appreciated.

Answer 1

A number of suggestions:

1) Use "-A PREROUTING" if you're going to add things to the bottom of the table. If you want to add a bunch of things to the top, drop the number. By default -I uses 1. This saves you having to renumber your lines if you add additional lines.

2) You have both /bin/bash and /bin/sh at the top. Drop the /bin/sh. It won't do anything having both, but it might be confusing.

3) Negate your check for root and take the body of the script out of the if statement. This makes the code cleaner. I'd probably also scrap the ROOT_UID variable too, as you only use it once, and the condition and error message make it clear what you're checking.

Finally, and possibly most importantly, don't write iptables rules by hand. Use something like shorewall and let that deal with the complexity. You could replace your script with something like:

DNS/DNAT       net             loc:10.0.0.9    -    -      -   83.100.256.28

Which means redirect any DNS traffic from the internet zone originally to 83.100.256.28 to 10.0.0.9 on the local network. It will add all the iptables rules you need.