Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want connections coming in on ppp0 on port 8001 to route to 192.168.1.200 on eth0 on port 8080

I've got these two rules

-A PREROUTING  -p tcp -m tcp --dport 8001 -j DNAT --to-destination 192.168.1.200:8080

-A FORWARD -m state -p tcp -d 192.168.1.200 --dport 8080 --state NEW,ESTABLISHED,RELATED -j ACCEPT

and it doesn't work, what am I missing?

share|improve this question
1  
NAT HOWTO –  Paul Tomblin Dec 5 '08 at 21:11
    
I'm going to go with the n-p-r tag (although this could be programming-related, though poorly phrased of course.) –  Mihai Limbăşan Dec 5 '08 at 22:12
    
How about this: I'm a programmer trying to set up an environment so I can debug my server application in eclipse being called from the innernet. Close enough? –  stu Dec 5 '08 at 22:30
    
Sure, that's what I meant by "poorly phrased"... Could you edit the question accordingly? –  Mihai Limbăşan Dec 5 '08 at 23:19
add comment

migrated from stackoverflow.com May 11 '10 at 12:55

This question came from our site for professional and enthusiast programmers.

4 Answers

up vote 30 down vote accepted

First of all - you should check if forwarding is allowed at all:

cat /proc/sys/net/ipv4/conf/ppp0/forwarding 
cat /proc/sys/net/ipv4/conf/eth0/forwarding 

If both returns 1 it's ok. If not do the following:

echo '1' > /proc/sys/net/ipv4/conf/ppp0/forwarding
echo '1' > /proc/sys/net/ipv4/conf/eth0/forwarding

Second thing - DNAT could be applied on nat table only. So, your rule should be extended by adding table specification as well (-t nat):

iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 8001 -j DNAT --to-destination 192.168.1.200:8080
iptables -A FORWARD -p tcp -d 192.168.1.200 --dport 8080 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Both rules are applied only to TCP traffic (if you want to alter UDP as well, you need to provide similar rules but with -p udp option set).

Last, but not least is routing configuration. Type:

ip route

and check if 192.168.1.0/24 is among returned routing entries.

share|improve this answer
1  
I personally prefer the sysctl syntax like sysctl net.ipv4.conf.eth0.forwarding=1 –  Doud Sep 7 '12 at 21:10
    
How do I remove the incorrectly entered rule? –  Nickolai Leschov Apr 13 at 2:51
add comment

I think what you want is:

iptables -A FORWARD -m state -p tcp -d 192.168.1.200 --dport 8080 --state 
    NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 8001 -j DNAT --to-destination
    192.168.1.200:8080
share|improve this answer
1  
ummm... that IS what I have already. I use iptables-restore to load it so each is in its own section, but that's what I wrote above. –  stu Dec 5 '08 at 22:21
    
Okay, the syntax looked bad in the original. Did you try -i ppp0 in the rules? What is the problem exactly? –  Robert Gamble Dec 5 '08 at 23:17
add comment

You forget postrouting source address SNAT 'ing:

sysctl net.ipv4.ip_forward=1
yours_wan_ip=101.23.3.1
-A PREROUTING  -p tcp -m tcp -d $yours_wan_ip --dport 8001 -j DNAT --to-destination 192.168.1.200:8080

-A FORWARD -m state -p tcp -d 192.168.1.200 --dport 8080 --state NEW,ESTABLISHED,RELATED -j ACCEPT

-A POSTROUTING -p tcp -m tcp -s 192.168.1.200 --sport 8080 -j SNAT --to-source $yours_wan_ip

And don't forget to set your linux firewall as default gateway on computer with 192.168.1.200 address.

share|improve this answer
add comment

Try

echo "1" > /proc/sys/net/ipv4/conf/ppp0/forwarding
echo "1" > /proc/sys/net/ipv4/conf/eth0/forwarding

These files tell the kernel it's allowed to forward packets between the interfaces.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.