0

This is all the rules I currently have on the server:

/usr/sbin/iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 6112 -j DNAT --to 10.0.0.3:6112
/usr/sbin/iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 1513 -j DNAT --to 10.0.0.3:1513

/usr/sbin/iptables -I FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
/usr/sbin/iptables -A FORWARD -i eth0 -j ACCEPT
/usr/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
/usr/sbin/iptables -A FORWARD -i eth1 -o eth0 -m state --state NEW,ESTABLISHED -j ACCEPT
/usr/sbin/iptables -A FORWARD -j LOG

/usr/sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

I need some help with some really basic needs, all I need to allow in this server is people to be able to connect to it on ports 1513 and 6112 in and out as well as being able to ping the server nothing else is need on the firewall for external access.

eth0 is the local network interface and eth1 the external network interface, I use 10.0.0.0/255.255.255.0 as my local network.

Are these rules sufficient for my needs or am I missing anything ?

UPDATE:

root@server:~# iptables -L; iptables -t nat -L; iptables -t mangle -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
TCPMSS     tcp  --  anywhere             anywhere            tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            state NEW,ESTABLISHED
LOG        all  --  anywhere             anywhere            LOG level warning

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere            tcp dpt:6112 to:10.0.0.3:6112
DNAT       tcp  --  anywhere             anywhere            tcp dpt:fujitsu-dtc to:10.0.0.3:1513

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
3
  • Do you have any rule for INPUT?
    – ghm1014
    Jul 25, 2011 at 20:04
  • those are all the rules I have, it works for allowing the local network to use the internet just fine. The problem I am having mainly is that not everyone can see the servers at 6112 and 1513 and if I plug the internet direct on that machine it will work just fine which leads me to firewall problems.
    – Guapo
    Jul 25, 2011 at 20:06
  • Is the LOG rule getting matches it shouldn't be? Jul 25, 2011 at 23:18

2 Answers 2

0

You're missing a second line for each of the PREROUTING commands. You've changed the destination IP, but there's nothing in the FORWARD table to actually allow the traffic.

Try the following extra commands:

/usr/sbin/iptables -A FORWARD -i eth1 -p tcp --dport 6112 -d 10.0.0.3:6112 -j ACCEPT

/usr/sbin/iptables -A FORWARD -i eth1 -p tcp --dport 1513 -d 10.0.0.3:1513 -j ACCEPT

2
  • Yes there are 3 lines to allow traffic in and out on the FORWARD.
    – Guapo
    Jul 25, 2011 at 21:15
  • A fair point. What I wrote is what's in my script, however. Perhaps incoming packets are hitting outside of the NEW or ESTABLISHED? I'll often add more specific rules to allow certain classes of packets when iptables doesn't run according to what I expect. Care to humor me and try the above lines? Jul 25, 2011 at 22:03
0

Look at Shorewall and its example 2-interface solution. It is easy to enable particular ports in and set up masquerading. Your rule will likely include these:

DNAT        net   loc:10.0.0.3  tcp   1513
DNAT        net   loc:10.0.0.3  tcp   6112
Ping(DNAT)  net   loc:10.0.0.3 
2
  • I appreciate it but this time all I really need is iptables and how to do it with it and find where the issue might be knowing it is within the firewall it self, I have also tried lowering the external interface MTU to 1280 and the rule iptables -I FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu. The main issue here is not that the rules are not working but something that is still limiting it from working fully as when I the give internal computer plugged direct on the internet.
    – Guapo
    Jul 26, 2011 at 4:36
  • Shorewall does the iptables for you and makes it much simpler to get it right.
    – BillThor
    Jul 26, 2011 at 13:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .