Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to set up port forwarding on a linux box to a IIS webserver on my internal network. The web server sits on Windows 2003 Server.

My linux box has:

  • eth0 - Internet connection
  • eth1 - internal subnet (10.10.10.x)
  • eth2 - 2nd internal subnet (192.168.0.x) dhcp interface

My webserver is on the eth2 interface (192.168.0.6)

I am doing port forwarding for port 80 with no avail. I use the same set of rules to port forward to a different webserver and it works.

The webapplication is available on the internal network but not for external users.

iptables -t nat -A PREROUTING -p tcp -i eth0 -d $PUBLIC_IP --dport 80 -j DNAT --to 192.168.0.6:80
iptables -A FORWARD -p tcp -i eth0 -o eth2 -d 192.168.0.6 --dport 80 -m state --state NEW -j ACCEPT
iptables -A FORWARD -t filter -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -t filter -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Any Ideas?

share|improve this question
    
Perhaps a silly question, but are you able to use curl/lynx to access your IIS server from your Linux box? –  Zoredache Mar 12 '10 at 4:18
    
Yes I can, i can hit the IIS server from linux, telnet to it, scan it for open ports and it shows everything –  Simon Mar 12 '10 at 20:39

4 Answers 4

up vote 1 down vote accepted

Thanks everyone for their answers. The problem was found in the network configuration on the IIS server box. For some reason the default gateway wasn't configured... doh, Leason learned, don't trust what others tell you.

The rules i originally used do work.

share|improve this answer

maybe this doesn't fit your security model, but you may want to look into installing apache and using it's proxy module to route traffic to your IIS web server. On top of that, you can configure it to filter out all URLS except ones you strictly define, allowing your IIS installation to be more secure.

Apache Config file:

       <Proxy *>
               # deny most all requests
               Order deny,allow
               # allow from your internal network
               Allow from 192.168.x.x
       </Proxy>

       ProxyPass /yoursite http://internal_site/yoursite
share|improve this answer
    
I would recommend something lighter, like nginx, if there's only need for proxying and nothing more. –  Mikael S Mar 11 '10 at 23:54
    
I'll probably give this a try, i am running squid for my internal network on this linux box as a transparent proxy –  Simon Mar 12 '10 at 20:40

I don't think you need to use MASQUERADE. Try using SNAT instead.

share|improve this answer

I've always had luck with IIS and iptables using the following script:

$IPTABLES -P INPUT DROP $IPTABLES -P OUTPUT DROP $IPTABLES -P FORWARD DROP

$IPTABLES -t nat -A PREROUTING -j DNAT -p tcp -d $EXT_IP --dport $WWW_PORT --to-destination $WWW_IP $IPTABLES -t nat -A POSTROUTING -o $EXT_IFACE -j MASQUERADE

$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A INPUT -p all -i $LO_IFACE -j ACCEPT $IPTABLES -A INPUT -p all -s $LO_IP -j ACCEPT

$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -m state ! --state NEW -j DROP $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -p tcp -i $EXT_IFACE -s $ANY -d $WWW_IP --dport $WWW_PORT -j ACCEPT

$IPTABLES -A FORWARD -p all -i $INT_IFACE -j ACCEPT

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.