Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is all the rules I currently have on the server:

/usr/sbin/iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 6112 -j DNAT --to 10.0.0.3:6112
/usr/sbin/iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 1513 -j DNAT --to 10.0.0.3:1513

/usr/sbin/iptables -I FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
/usr/sbin/iptables -A FORWARD -i eth0 -j ACCEPT
/usr/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
/usr/sbin/iptables -A FORWARD -i eth1 -o eth0 -m state --state NEW,ESTABLISHED -j ACCEPT
/usr/sbin/iptables -A FORWARD -j LOG

/usr/sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

I need some help with some really basic needs, all I need to allow in this server is people to be able to connect to it on ports 1513 and 6112 in and out as well as being able to ping the server nothing else is need on the firewall for external access.

eth0 is the local network interface and eth1 the external network interface, I use 10.0.0.0/255.255.255.0 as my local network.

Are these rules sufficient for my needs or am I missing anything ?

UPDATE:

root@server:~# iptables -L; iptables -t nat -L; iptables -t mangle -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
TCPMSS     tcp  --  anywhere             anywhere            tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            state NEW,ESTABLISHED
LOG        all  --  anywhere             anywhere            LOG level warning

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere            tcp dpt:6112 to:10.0.0.3:6112
DNAT       tcp  --  anywhere             anywhere            tcp dpt:fujitsu-dtc to:10.0.0.3:1513

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
share|improve this question
    
Do you have any rule for INPUT? –  ghm1014 Jul 25 '11 at 20:04
    
those are all the rules I have, it works for allowing the local network to use the internet just fine. The problem I am having mainly is that not everyone can see the servers at 6112 and 1513 and if I plug the internet direct on that machine it will work just fine which leads me to firewall problems. –  Guapo Jul 25 '11 at 20:06
    
Is the LOG rule getting matches it shouldn't be? –  Mark Wagner Jul 25 '11 at 23:18
add comment

2 Answers

You're missing a second line for each of the PREROUTING commands. You've changed the destination IP, but there's nothing in the FORWARD table to actually allow the traffic.

Try the following extra commands:

/usr/sbin/iptables -A FORWARD -i eth1 -p tcp --dport 6112 -d 10.0.0.3:6112 -j ACCEPT

/usr/sbin/iptables -A FORWARD -i eth1 -p tcp --dport 1513 -d 10.0.0.3:1513 -j ACCEPT

share|improve this answer
    
Yes there are 3 lines to allow traffic in and out on the FORWARD. –  Guapo Jul 25 '11 at 21:15
    
A fair point. What I wrote is what's in my script, however. Perhaps incoming packets are hitting outside of the NEW or ESTABLISHED? I'll often add more specific rules to allow certain classes of packets when iptables doesn't run according to what I expect. Care to humor me and try the above lines? –  Jeff McJunkin Jul 25 '11 at 22:03
add comment

Look at Shorewall and its example 2-interface solution. It is easy to enable particular ports in and set up masquerading. Your rule will likely include these:

DNAT        net   loc:10.0.0.3  tcp   1513
DNAT        net   loc:10.0.0.3  tcp   6112
Ping(DNAT)  net   loc:10.0.0.3 
share|improve this answer
    
I appreciate it but this time all I really need is iptables and how to do it with it and find where the issue might be knowing it is within the firewall it self, I have also tried lowering the external interface MTU to 1280 and the rule iptables -I FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu. The main issue here is not that the rules are not working but something that is still limiting it from working fully as when I the give internal computer plugged direct on the internet. –  Guapo Jul 26 '11 at 4:36
    
Shorewall does the iptables for you and makes it much simpler to get it right. –  BillThor Jul 26 '11 at 13:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.