Using IPTables to forward port for incoming eth1(local) to outgoing ppp0 (vpn) to specific ip address

Question

So I have a VPN on ppp0 and I setup so I can use either ppp0 or eth1 to connect out with the default route being eth1.

Both reply to "ping google.com" (uses eth1) and "ping -I ppp0 google.com" (uses VPN)

Goal: If I connect to eth1 on port 12345 it will forward out ppp0 to a specific ip address (123.123.123.123).

eth1: local network
ppp0: vpn service
local network: 10.10.1.0/24
forwarding ip: 123.123.123.123
port: 12345

ports can be different the same doesnt matter, if it works :)

iptables -t nat -A PREROUTING -p tcp -i eth1 -d 10.10.1.0/24 --dport 12345 -j DNAT --to-destination 123.123.123.123:12345
iptables -A FORWARD -p tcp -o ppp0 -d 123.123.123.123 --dport 12345 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

After searching this is what most people say. Use the PREROUTE to set new destination. Then forward out ppp0. But its not working and I don't know how to actually see what its doing.

Answer 1

You can try to mark your packets with iptables with MARK, somethink like that after or before your dnat :

iptables -t mangle -A PREROUTING -p tcp -d 123.123.123.123 --dport 12345 -j MARK --set-mark 111

After you can set a specific route for this :

ip rule add fwmark 111 lookup 100

ip route add local 0.0.0.0/0 dev ppp0 table 100

Answer 2

That's probably because the NAT rule just gives it a new destination IP address, which then gets routed trough eth1. Then the filter rule does not apply.

You'd need to either create a route for this specific destination going trough ppp0 (if it is fine for all the traffic bound to this destination to go trough the vpn), or use the mangle table to hand-pick a destination for this traffic.

Answer 3

iptables -t nat -A PREROUTING -p tcp -i eth1 -d 10.10.1.0/24 \
  --dport 12345 -j DNAT --to-destination 123.123.123.123:12345

Locally generated traffic will never pass through the PREROUTING chain. You can verify this by adding a rule like this:

iptables -t nat -A PREROUTING -j log -m limit --limit 1/s

If you're not familiar with iptables, the above rule means:

• Log (at a maximum rate of 1 message/second) any packets traversing the PREROUTING chain.

Watch your log files while you make outbound connections, and you'll see that nothing is passing through this chain. The PREROUTING chain only comes into play for traffic coming into your system from an outside source.

You might think you could do this in the OUTPUT chain:

iptables -t nat -A OUTPUT ... -j DNAT ...

But by the time a packet hits the OUTPUT chain the routing decision has already been made. You can probably get you want by using a REDIRECT rule in the OUTPUT chain and then running a tcp proxy on a local port that redirects connections to your destination. That is, you can add a rule like this:

iptables -t nat -A OUTPUT -p tcp -d 10.10.1.0/24 --dport 12345 \
  -j REDIRECT --to-ports 12345

And then run a tcp proxy locally on port 12345.