0

I have an Ubuntu machine running as a firewall. This machine has our static IP configured on eth1. It is connected to our network via eth0.

I have a new server running Server2012 with IIS installed. It is a sharepoint server. I need the sharepoint server to be accessible to the internet and the local network via a domain name. i.e. "awesomebox.net"

What is the IPTables rule I need to make this happen?

Where I'm at:

I have a rule in the nat table to redirect incoming requests to our sharepoint server. It works OUTSIDE our building. When I try to access it from INSIDE our building, I get the apache server on our local firewall.

sudo iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 10.100.XX.XX:80
sudo iptables -A FORWARD -i eth1 -p tcp --dport 80 -d 10.100.XX.XX -j ACCEPT
sudo iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 443 -j DNAT --to 10.100.XX.XX:443
sudo iptables -A FORWARD -i eth1 -p tcp --dport 443 -d 10.100.XX.XX -j ACCEPT

What am I missing here?

Improve this question
3
  • Did you really obscure your RFC1918 addresses? That's rather pointless...
    – Michael Hampton
    Feb 14, 2013 at 20:31
  • Sorry if it bothers you. I'm just a programmer who has been forced into some server admin stuff. Not sure what the rules are around here so it's better safe than sorry.
    – Jason Maggard
    Feb 14, 2013 at 20:49
  • You don't have to obscure anything, as far as we care. In fact, it's almost always better if you don't. Only if you have sensitive information would you need to consider obscuring it, (like the name of your company) but RFC1918 addresses aren't, by definition.
    – Michael Hampton
    Feb 14, 2013 at 20:58

1 Answer 1

Reset to default
1

Your rules are only applied to packets entering on eth1 from the Internet, and so won't be applied to packets entering on eth0 from the LAN. Either add another set of rules specifying eth0, or remove that condition from the current rules:

iptables -t nat -A PREROUTING -d 1.2.3.4 -p tcp --dport 80 -j DNAT --to 10.100.XX.XX:80
iptables -A FORWARD -p tcp --dport 80 -d 10.100.XX.XX -j ACCEPT
iptables -t nat -A PREROUTING -d 1.2.3.4 -p tcp --dport 443 -j DNAT --to 10.100.XX.XX:443
iptables -A FORWARD -p tcp --dport 443 -d 10.100.XX.XX -j ACCEPT

If the SharePoint server is connected to eth0 you're going to run into the hairpin NAT problem. To address this you need to SNAT the outgoing packets if the source is the LAN subnet:

iptables -t nat -A POSTROUTING -p tcp --dport 80 -d 10.100.XX.XX -s 10.100.XX.0/24 -j MASQUERADE
iptables -t nat -A POSTROUTING -p tcp --dport 443 -d 10.100.XX.XX -s 10.100.XX.0/24 -j MASQUERADE
Improve this answer
2
  • Thanks. Wouldn't the first set of commands redirect all traffic bound for Port 80 to my internal server? i.e. if a user is trying to reach Google he's going to wind up talking to my internal server. Just making sure, I already "broke the internet" once today, I'm trying not to do it twice. :)
    – Jason Maggard
    Feb 14, 2013 at 20:46
  • @JasonMaggard Ah yes, you're correct. You should match the target IP specifically (edited).
    – mgorven
    Feb 14, 2013 at 20:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .