0

this is my scenario:

Netbook (192.168.1.2) ===> (192.168.1.1) Linux Server (192.168.0.4) ===> NAS (192.168.0.2)
Netbook (192.168.1.2) ===> (192.168.1.1) Linux Server (192.168.0.4) ===> Router (192.168.0.1)

I would like to do port forwarding with iptables in order to reach the NAS and Router on port 80 with my Netbook. Both servers have a service on port 80, so depending on what I decide to do sometimes I open port 80 on the NAS, sometimes on the Router.

IP forwarding is enabled, masquerading as well.

This is my /etc/iptables.ipv4.nat file:

 Generated by iptables-save v1.4.14 on Wed Apr 30 23:02:30 2014  
*nat :PREROUTING ACCEPT [42:14791] :INPUT ACCEPT [31:2623] :OUTPUT ACCEPT [1:48]
:POSTROUTING ACCEPT [1:48]  
-A PREROUTING -i wlan1 -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 22  
-A PREROUTING -i wlan1 -p udp -m udp --dport 53 -j REDIRECT --to-ports 53  
-A PREROUTING -i wlan1 -p tcp -m tcp --dport 5901 -j DNAT --to-destination 192.168.0.2:5901  
-A PREROUTING -i wlan1 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040  
-A POSTROUTING -o wlan1 -j MASQUERADE COMMIT  
 Completed on Wed Apr 30 23:02:30 2014  
 Generated by iptables-save v1.4.14 on Wed Apr 30 23:02:30 2014  
*filter :INPUT ACCEPT [904:141326] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [946:157235]  
-A FORWARD -d 192.168.0.0/24 -i wlan1 -o wlan0 -p tcp -m tcp --dport 5901 -j ACCEPT  
-A FORWARD -d 192.168.0.0/24 -i wlan1 -o wlan0 -p tcp -m tcp --dport 80 -j ACCEPT COMMIT  
 Completed on Wed Apr 30 23:02:30 2014  

Furthermore on my router (192.168.0.1) I have a static route: Network 192.168.1.0, Subnet 255.255.255.0, Gateway 192.168.0.4

The reason for the multiple /24 nets is that on the 192.168.1.0 net a DHCP server is running for all the connected devices to the Linux Server which is acting as an access point and TOR router (port 9040). At the same time a DHCP server is running on the router 192.168.0.1 for the devices connecting to the router.

The port forwarding for port 5901 works like a charm by the way.

6
  • Sounds like you're having a routing issue, and not an actual firewall issue. It would make more sense for you to build a 2nd subnet on your router or use your Linux server as a default gateway between the two different subnets.
    – CIA
    May 6, 2014 at 19:19
  • On my router there is a static route which enables my devices to ping each other. As soon as i try to address a specific port related service (80, 5901, etc) without any port-forwarding, I won't have any access. The traffic is blocked. So far the only solution that somehow works is port-forwarding in combination with the static route.
    – Daniel
    May 6, 2014 at 19:22
  • Can you provide the static route(s) in your question?
    – CIA
    May 6, 2014 at 19:24
  • sure, sorry for that, question is updated
    – Daniel
    May 6, 2014 at 19:30
  • Is there a reason you have multiple /24 subnets?
    – CIA
    May 6, 2014 at 19:35

1 Answer 1

0

Unless I am misunderstanding, why not simply map different target ports on the Linux Server to port 80 on the backend devices. For example:

Netbook --> 192.168.1.1:8080 (Linux Server) --> 192.168.0.2:80 (NAS)
Netbook --> 192.168.1.1:8081 (Linux Server) --> 192.168.0.1:80 (Router)

You already have the commands you need, you just need to set --dport to a different target port on the Linux Server, while specifying port 80 in --to-destination.

3
  • Good idea but unpractical. I would need to always specify the port 8080 or 8081 requesting the NAS or Router. I dont wanna do that. I just want to open the IP address in the netbooks browser (192.168.0.2 or 192.168.0.1) and open the appropriate web service on their port 80. best solution would be to route the traffic on port 80 1:1 to the other subnet without a different handling of the ports. Firewalls usually have this option. I tried to set the --to-destination to 192.168.0.0:80 (in order to address the whole subnet) but that didn't work out.
    – Daniel
    May 6, 2014 at 18:20
  • So you just want to route the traffic, not using any port NAT?
    – Kyle Smith
    May 6, 2014 at 18:30
  • If possible, yes. I've tried uncountable suggestions without NAT but using the NAT rules above is so far the only thing that worked at all.
    – Daniel
    May 6, 2014 at 18:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .