Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are using Stunnel. But want to replace it is with an iptables entry if possible.

192.168.123.122:7300 need to be forwarded to 192.168.123.188:7300. So in iptables I set these two entries:

[root@dev ~]# iptables -t nat -A PREROUTING -p tcp --dport 7300 -j DNAT --to-destination 192.168.123.188:7300
[root@dev ~]# iptables -A FORWARD -m state -p tcp -d 192.168.123.188 --dport 7300 --state NEW,ESTABLISHED,RELATED -j ACCEPT

But it isn't working.

I did check that /proc/sys/net/ipv4/conf/eth0/forwarding has the value "1" inside.

Any tips or hints?

thanks, Patrick

share|improve this question
    
I'm guessing you're already aware that stunnel doesn't just re-route traffic, it wraps it in SSL - and iptables doesn't –  symcbean Nov 25 '10 at 10:09

2 Answers 2

have you add Masquerade ?

iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0

share|improve this answer

To enable IP forwarding, I usually change the value of /proc/sys/net/ipv4/ip_forward to 1.

To make it permanent, I uncomment the line: net.ipv4.ip_forward=1 in /etc/sysctl.conf.

You did not mention from where you are making your request.

Also, you need to be careful about choosing the correct chains (INPUT, FORWARD, PREROUTING, etc.). The INPUT chain is used to process the packets destined to the firewall itself. The OUTPUT chain is used for the packets originated from the firewall host. The FORWARD is used for those packets passing through the firewall.

At the end, tcpdump is your friend when you are not sure which firewall rule is not working. You can trace the traffic coming and going out of your firewall.

share|improve this answer
    
[root@dev ~]# cat /proc/sys/net/ipv4/ip_forward 1 that is there also yes –  Patrick van Hout Nov 25 '10 at 8:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.