Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have the folowwing scenario is the router who forward to iptable the remote control to a MS Server 2008 nevertheless i haven't been able to make it work with the current iptable rule i have: enter image description here

-A PREROUTING -p tcp --dport 3389 --destination 192.168.0.5
-A PREROUTING -p udp --dport 3389 --destination 192.168.0.5

192.168.0.5 is the address of the MS Server, so i try to redirect the request to it. Any suggestion.

Edit

this is what /etc/init.d/iptable status throws with 3389 grp

10   ACCEPT     tcp  --  0.0.0.0/0            192.168.0.5         tcp dpt:3389
113  ACCEPT     tcp  --  192.168.0.0/24       0.0.0.0/0           multiport dports 21,25,110,1143,143,2082,2095,2525,3306,3389,7080,7777
11   DNAT       tcp  --  0.0.0.0/0            190.181.129.51      tcp dpt:3389 to:192.168.0.5:3389
12   DNAT       udp  --  0.0.0.0/0            190.181.129.51      udp dpt:3389 to:192.168.0.5:3389
share|improve this question
add comment

2 Answers 2

iptables -t nat -A PREROUTING -p tcp -d <IP_OF_YOUR_ROUTER> --dport 3389 -j DNAT --to-destination 192.168.0.5:3389
iptables -A FORWARD -p tcp -d 192.168.0.5 --dport 3389 -j ACCEPT
share|improve this answer
    
try it but still doesnt work any suggestion to approach this? –  Necronet May 12 '11 at 16:55
    
If you're using an IP Forward rule, verify that /proc/sys/net/ipv4/ip_forward is set to 1. This can be set in /etc/sysctl.conf (look for net.ipv4.ip_forward) or with the sysctl command also. –  Grahamux May 12 '11 at 17:17
    
it is set 1 ... –  Necronet May 12 '11 at 17:42
    
why -d <IP_OF_YOUR_ROUTER> and not of my firewall ip address isnt the destiny address? –  Necronet May 12 '11 at 20:32
    
it should be your firewall. Try it with that ip. –  wullxz May 13 '11 at 8:55
show 1 more comment

Try executing this script : -

    #!/bin/bash

    #Uncomment the following line to enable ip forwarding if it is not already enabled.
    #echo 1 > /proc/sys/net/ipv4/ip_forward

    #nat rules to change destination ip address to the ip address of MS server
    iptables -t nat -A PREROUTING -p tcp -d <IP Address of the router/machine on which you are planning to execute this script> --dport 3389 -j DNAT --to 192.168.0.5


    #Allow response from MS server to router/machine on which you execute this script 
    iptables -t nat -A POSTROUTING -d 192.168.0.5 -j MASQUERADE

If the above script does not work, clear the above rules and try the following script : -

    #!/bin/bash

    #Uncomment the following line to enable ip forwarding if it is not already enabled.
    #echo 1 > /proc/sys/net/ipv4/ip_forward

    #nat rules to change destination ip address to the ip address of MS server
    iptables -t nat -A PREROUTING -p tcp -d <IP Address of the router/machine on which you are planning to execute this script> --dport 3389 -j DNAT --to 192.168.0.5:3389


    #Allow response from MS server to router/machine on which you execute this script 
    iptables -t nat -A POSTROUTING -d 192.168.0.5 -j MASQUERADE
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.