1

I have the following infrastructure in place:

 internet   [outside 81.x.x.x] router [inside 192.168.1.1] 
                                    |    [network 192.168.1.0/24] 
                                    | 
                                   mail server [192.168.1.2]

On the router (DD-WRT) with iptables. I have NAT enabled since I want my mailserver to respond for the outside IP. I have the following setup:

iptables -t nat -I PREROUTING -d 81.x.x.x -j DNAT --to 192.168.1.2 
iptables -t nat -I POSTROUTING -s 192.168.1.2 -j SNAT --to 81.x.x.x 
iptables -I FORWARD -d 192.168.1.2 -p tcp --dport 25 -j ACCEPT

with some other open ports as well.

However, when mail arrives to the mailserver postfix show the following message:

postfix/smtpd[6964]: connect from unknown[192.168.1.1]

All mails coming from outside seems that is comming with the routers inside IP address. What am I missing, so that the original IP address is shown, instead of the routers inside IP?

5
  • 1
    Your first iptables rule (DNAT) is missing protocol & dest. port selection, is that intentional? Feb 22, 2015 at 7:10
  • @sam_pan_mariusz It's called 1-to-1 NAT. Feb 22, 2015 at 14:28
  • @Michael Hampton - It's not clear in the question, but looks like Zoli has 1-to-1 NAT on the same public IP address as he uses for SNAT. I never met anything like that, wonder how it works. 1-to-1 often makes sense with mail servers, but only when there's more than one public IP. Feb 22, 2015 at 17:40
  • @sam_pan_mariusz Yes, it's 1-to-1 NAT, I have more than one public IP and more servers for what I'm doing NAT.
    – Zoli
    Feb 22, 2015 at 18:48
  • Are you sure these are the only SNAT rules in your firewall? I suspect some other rule is not shown above applying the undesired effect.
    – Zoredache
    Feb 22, 2015 at 20:08

2 Answers 2

0

You appear to have set up a 1-to-1 NAT with the first two iptables rules, but then you've added a third, rather curious rule:

iptables -I FORWARD -d 192.168.1.2 -p tcp --dport 25 -j ACCEPT

Such rules aren't necessary when doing 1-to-1 NAT, and don't actually do anything useful. Of the information you've given, this appears to be the most likely cause of the problem. Simply remove it.

iptables -D FORWARD -d 192.168.1.2 -p tcp --dport 25 -j ACCEPT
2
  • 1
    Even if the default policy for the FORWARD chain is DROP or REJECT? I was going to suggest deleting the second rule, since the SNAT should only be necessary for outgoing connections. A complete list of iptables -t nat -L -n might help. Feb 22, 2015 at 16:30
  • Hm, if the forward policy is DROP then you might need something like that after all. I stopped using DD-WRT some time ago since it's basically unmaintained anymore. Feb 22, 2015 at 16:32
0

ISTR oddities like this before, but there's something missing as you say. The following information might be useful from the router:

iptables -t nat -L -n
iptables -L -n
ip route

And this from the mail server:

iptables -t nat -L -n
ip route
grep . /proc/sys/net/ipv4/conf/*/rp_filter

Without that info, I think I'd just wipe out your existing firewall and do something more specific:

iptables -t nat -F  # also on server
iptables -t nat -I PREROUTING -p tcp -d 81.x.x.x --dport 25 \
    -j DNAT --to 192.168.1.2:25

And see what is happening in the mail logs. If you need the SNAT for outgoing SMTP, something like:

iptables -t nat -I POSTROUTING -p tcp -s 192.168.1.2 --dport 25 \
    -m multiport --sports 1024:65535 -j SNAT --to 81.x.x.x:25

And if a local DNS resolver is insufficient:

iptables -t nat -I POSTROUTING -p udp -s 192.168.1.2 --dport 53 \
    -j SNAT --to 81.x.x.x
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .