1

I am trying to implement iptables forwarding rules in order to internally redirect packets coming through a specific port.

My machine is running under the distribution Ubuntu Server 12.04.3, with UFW and all the latest updates.

So far, I was able to establish a partially-working setup, shown hereafter:

iptables -A PREROUTING -t nat -p tcp --dport 40591 -j DNAT --to 192.168.0.100:40591
iptables -A ufw-user-forward -p tcp -d 192.168.0.100 --dport 40591 -j ACCEPT
iptables -t nat -A POSTROUTING -j MASQUERADE
iptables -A ufw-user-forward -m state --state RELATED,ESTABLISHED -j ACCEPT

As shown in the block, the destination recipient is 192.168.0.100 and the port 40591.

However, issues arose shortly after, I noticed my apache2 service was outputting LOTS of errors; my PHP scripts were no longer able to connect to my database via 127.0.0.1, as connections were purportedly initiated from its LAN address (192.168.0.10).

In order to confirm the source of the problem, I have tried:

  1. strace-ing my PHP script, but no conclusive information was spat out, aside from confirming what I already knew (i.e. connections being initiated locally and magically deflected to the server's local address (192.168.0.10))
  2. tcpdump-ing on port 3306 with the command tcpdump -e -i any -n -s0 tcp port 3306

tcpdump

Before (adding the rules)

04:51:30.043660  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 76: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [S], seq 1373736824, win 43690, options [mss 65495,sackOK,TS val 33638495 ecr 0,nop,wscale 7], length 0
04:51:30.043679  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 76: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [S.], seq 3532787939, ack 1373736825, win 43690, options [mss 65495,sackOK,TS val 33638495 ecr 33638495,nop,wscale 7], length 0
04:51:30.043692  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [.], ack 1, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 0
04:51:30.043935  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 163: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [P.], seq 1:96, ack 1, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 95
04:51:30.043992  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [.], ack 96, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 0
04:51:30.044044  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 173: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [P.], seq 1:106, ack 96, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 105
04:51:30.044077  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [.], ack 106, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 0
04:51:30.044152  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 79: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [P.], seq 96:107, ack 106, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 11
04:51:30.044240  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 115: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [P.], seq 106:153, ack 107, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 47
04:51:30.044560  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 413: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [P.], seq 107:452, ack 153, win 342, options [nop,nop,TS val 33638496 ecr 33638495], length 345
04:51:30.052507  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 204: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [P.], seq 153:289, ack 452, win 350, options [nop,nop,TS val 33638498 ecr 33638496], length 136
04:51:30.052907  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 471: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [P.], seq 452:855, ack 289, win 350, options [nop,nop,TS val 33638498 ecr 33638498], length 403
04:51:30.053042  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 302: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [P.], seq 289:523, ack 855, win 359, options [nop,nop,TS val 33638498 ecr 33638498], length 234
04:51:30.092217  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 79: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [P.], seq 855:866, ack 523, win 359, options [nop,nop,TS val 33638507 ecr 33638498], length 11
04:51:30.092377  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 73: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [P.], seq 523:528, ack 866, win 359, options [nop,nop,TS val 33638508 ecr 33638507], length 5
04:51:30.092404  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [F.], seq 528, ack 866, win 359, options [nop,nop,TS val 33638508 ecr 33638507], length 0
04:51:30.092427  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [F.], seq 866, ack 529, win 359, options [nop,nop,TS val 33638508 ecr 33638508], length 0
04:51:30.092446  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [.], ack 867, win 359, options [nop,nop,TS val 33638508 ecr 33638508], length 0

After

04:32:38.264052  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 76: 192.168.0.10.46454 > 127.0.0.1.3306: Flags [S], seq 344014396, win 43690, options [mss 65495,sackOK,TS val 33355550 ecr 0,nop,wscale 7], length 0
04:32:38.264072  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 76: 127.0.0.1.3306 > 127.0.0.1.46454: Flags [S.], seq 1406967667, ack 344014397, win 43690, options [mss 65495,sackOK,TS val 33355550 ecr 33355550,nop,wscale 7], length 0
04:32:38.264086  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 192.168.0.10.46454 > 127.0.0.1.3306: Flags [.], ack 1406967668, win 342, options [nop,nop,TS val 33355550 ecr 33355550], length 0
04:32:38.264337  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 141: 127.0.0.1.3306 > 127.0.0.1.46454: Flags [P.], seq 1:74, ack 1, win 342, options [nop,nop,TS val 33355551 ecr 33355550], length 73
04:32:38.264388  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.3306 > 127.0.0.1.46454: Flags [F.], seq 74, ack 1, win 342, options [nop,nop,TS val 33355551 ecr 33355550], length 0
04:32:38.264450  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 192.168.0.10.46454 > 127.0.0.1.3306: Flags [.], ack 74, win 342, options [nop,nop,TS val 33355551 ecr 33355551], length 0
04:32:38.264488  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 192.168.0.10.46454 > 127.0.0.1.3306: Flags [F.], seq 0, ack 75, win 342, options [nop,nop,TS val 33355551 ecr 33355551], length 0
04:32:38.264506  In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.3306 > 127.0.0.1.46454: Flags [.], ack 2, win 342, options [nop,nop,TS val 33355551 ecr 33355551], length 0

Ergo, my setup has gone haywire and I'm not quite sure how to implement a stable, NAT-ed forward setup using iptables rules.

So my question is: what is causing this issue and how could I remedy to it?

Thanks.

1 Answer 1

1

It's unclear to me if you're doing this on a single-homed or dual-homed machine. You're not specifying any interfaces in your iptables rules and that has me puzzled.

It looks to me like the iptables -t nat -A POSTROUTING -j MASQUERADE rule is your culprit. That's going to cause outgoing traffic on all your interfaces to be SNAT'ted to the interface's IP address. I don't think you want that. You should be specifying your Internet-facing interface on that rule as the -o interface.

6
  • I will try and do some research on my end about masquerading and see what I get, I'll post my results. FYI: I only have a single interface aside from lo; my machine is single-homed.
    – peelz
    Jan 28, 2014 at 20:22
  • Is the box single-homed or multi-homed? Jan 28, 2014 at 20:24
  • See my edit; (Single homed)
    – peelz
    Jan 28, 2014 at 20:24
  • Well, it seems like that you were right. The problem was indeed due to not specifying any interface, which I fixed by changing my DNAT rule to iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0. Thanks! — scratch that, I'm still getting issues.
    – peelz
    Jan 28, 2014 at 20:30
  • After all, that's the only thing that was required to make this shoddy setup work; I had to make some (unrelated) trivial minor tweaks in order to get everything running correctly.
    – peelz
    Jan 28, 2014 at 20:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .