this is my scenario:
Netbook (192.168.1.2) ===> (192.168.1.1) Linux Server (192.168.0.4) ===> NAS (192.168.0.2)
Netbook (192.168.1.2) ===> (192.168.1.1) Linux Server (192.168.0.4) ===> Router (192.168.0.1)
I would like to do port forwarding with iptables in order to reach the NAS and Router on port 80 with my Netbook. Both servers have a service on port 80, so depending on what I decide to do sometimes I open port 80 on the NAS, sometimes on the Router.
IP forwarding is enabled, masquerading as well.
This is my /etc/iptables.ipv4.nat file:
Generated by iptables-save v1.4.14 on Wed Apr 30 23:02:30 2014 *nat :PREROUTING ACCEPT [42:14791] :INPUT ACCEPT [31:2623] :OUTPUT ACCEPT [1:48] :POSTROUTING ACCEPT [1:48] -A PREROUTING -i wlan1 -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 22 -A PREROUTING -i wlan1 -p udp -m udp --dport 53 -j REDIRECT --to-ports 53 -A PREROUTING -i wlan1 -p tcp -m tcp --dport 5901 -j DNAT --to-destination 192.168.0.2:5901 -A PREROUTING -i wlan1 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040 -A POSTROUTING -o wlan1 -j MASQUERADE COMMIT Completed on Wed Apr 30 23:02:30 2014 Generated by iptables-save v1.4.14 on Wed Apr 30 23:02:30 2014 *filter :INPUT ACCEPT [904:141326] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [946:157235] -A FORWARD -d 192.168.0.0/24 -i wlan1 -o wlan0 -p tcp -m tcp --dport 5901 -j ACCEPT -A FORWARD -d 192.168.0.0/24 -i wlan1 -o wlan0 -p tcp -m tcp --dport 80 -j ACCEPT COMMIT Completed on Wed Apr 30 23:02:30 2014
Furthermore on my router (192.168.0.1) I have a static route: Network 192.168.1.0, Subnet 255.255.255.0, Gateway 192.168.0.4
The reason for the multiple /24 nets is that on the 192.168.1.0 net a DHCP server is running for all the connected devices to the Linux Server which is acting as an access point and TOR router (port 9040). At the same time a DHCP server is running on the router 192.168.0.1 for the devices connecting to the router.
The port forwarding for port 5901 works like a charm by the way.