Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm hoping there's something obvious I've missed here. I have NAT rules set up to forward a few different ports to an internal machine. When a request comes in from the internet, everything works as planned.

However, if I hit my external IP from inside the network with the same port, the request terminates at the firewall machine instead of being forwarded to the right place.

Is there something obvious that I'm doing wrong? The generated iptables rules are below.

# Generated by iptables-save v1.4.4 on Wed Sep  7 20:36:37 2011
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:Cid4488E49C.0 - [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -s 10.0.0.11/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT 
-A INPUT -i lo -m state --state NEW -j ACCEPT 
-A INPUT -s XXX.XXX.XXX.XXX/32 -m state --state NEW -j ACCEPT 
-A INPUT -s 10.0.0.1/32 -m state --state NEW -j ACCEPT 
-A INPUT -p tcp -m tcp -m multiport --dports 5050,22,5900 -m state --state NEW -j ACCEPT 
-A INPUT -p udp -m udp --dport 67 -m state --state NEW -j ACCEPT 
-A INPUT -s 10.0.0.0/24 -m state --state NEW -j ACCEPT 
-A INPUT -j DROP 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -d 10.0.0.11/32 -p tcp -m tcp --dport 5900 -m state --state NEW -j ACCEPT 
-A FORWARD -d 10.0.0.10/32 -p tcp -m tcp --dport 5050 -m state --state NEW -j ACCEPT 
-A FORWARD -s 10.0.0.0/24 -m state --state NEW -j ACCEPT 
-A FORWARD -j DROP 
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -d 10.0.0.11/32 -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -o lo -m state --state NEW -j ACCEPT 
-A OUTPUT -m state --state NEW -j ACCEPT 
-A OUTPUT -p tcp -m tcp -m multiport --dports 5050,22,5900 -m state --state NEW -j Cid4488E49C.0 
-A OUTPUT -p udp -m udp --dport 67 -m state --state NEW -j Cid4488E49C.0 
-A OUTPUT -d 10.0.0.11/32 -p tcp -m tcp --dport 5900 -m state --state NEW -j ACCEPT 
-A OUTPUT -d 10.0.0.10/32 -p tcp -m tcp --dport 5050 -m state --state NEW -j ACCEPT 
-A OUTPUT -s 10.0.0.0/24 -m state --state NEW -j ACCEPT 
-A OUTPUT -j DROP 
-A Cid4488E49C.0 -d XXX.XXX.XXX.XXX/32 -j ACCEPT 
-A Cid4488E49C.0 -d 10.0.0.1/32 -j ACCEPT 
COMMIT
# Completed on Wed Sep  7 20:36:37 2011
# Generated by iptables-save v1.4.4 on Wed Sep  7 20:36:37 2011
*nat
:PREROUTING ACCEPT [114:15633]
:POSTROUTING ACCEPT [1:48]
:OUTPUT ACCEPT [1:48]
-A PREROUTING -d XXX.XXX.XXX.XXX/32 -p tcp -m tcp --dport 5050 -j DNAT --to-destination 10.0.0.10:5050 
-A PREROUTING -d XXX.XXX.XXX.XXX/32 -p tcp -m tcp --dport 5900 -j DNAT --to-destination 10.0.0.11:5900 
-A POSTROUTING -s 10.0.0.0/24 -o eth1 -j MASQUERADE 
-A OUTPUT -d XXX.XXX.XXX.XXX/32 -p tcp -m tcp --dport 5050 -j DNAT --to-destination 10.0.0.10:5050 
-A OUTPUT -d XXX.XXX.XXX.XXX/32 -p tcp -m tcp --dport 5900 -j DNAT --to-destination 10.0.0.11:5900 
COMMIT
# Completed on Wed Sep  7 20:36:37 2011
share|improve this question
    
hairpin nat. Many people solve the hairpin NAT problem with split horizon DNS. –  Zoredache Sep 8 '11 at 3:45
    
That is an option, but I'm trying to stay away from it because I know it could work. Our previous router (which sucked) was able to do this sort of setup just fine, I just can't figure out how to make fwbuilder/iptables do what I want in this case. –  demonbane Sep 8 '11 at 3:51
    
You could also solve the problem with SNAT. See kb.syneto.net/entry/92 for a general explaination of how SNAT can solve your problem. –  artifex Sep 8 '11 at 13:59

2 Answers 2

up vote 4 down vote accepted

If you are connecting to the 10.0.0.10 server from another machine on the 10.0.0.0/24 network there could be a problem with the way packets are routed. For example, if your source is 10.0.0.99 and you connect to 10.0.0.10 via the public IP address, the response packets from the 10.0.0.10 server will be sent directly to 10.0.0.99 which will drop them since it doesn't have a half-open connection with 10.0.0.10 (the half-open connection is with the public IP).

One possible solution is double NAT. Here's an example:

http://www.fwbuilder.org/4.0/docs/users_guide5/double_nat.html

Btw, a better place to get fwbuilder support is from either the fwbuilder mailing list or discussion forum on SF.

http://sourceforge.net/projects/fwbuilder/forums/forum/16372

https://lists.sourceforge.net/lists/listinfo/fwbuilder-discussion

share|improve this answer
    
That did it! Thanks very much for the help! –  demonbane Sep 9 '11 at 4:31

If it's open to the world and yOu can access the server via it's internal IP then I see no problem. If you really want tO access it from the external IP internally then I would ask to see a copy of the error lOg or access log on the NAT. Are you also perhaps behind a proxy or secOnd IP where your quote external endquote iP is different than that of the NAT? Hopefully we can solve this.

share|improve this answer
    
What I want is for any internal requests coming to my external IP to basically follow the same NAT rules as external requests. It seems like my NAT rules just get skipped if the origin of the request is internal. –  demonbane Sep 8 '11 at 3:29
    
That would be configured in the NAT. Can I ask what type of translator you are using so I can help further? –  U4iK_HaZe Sep 8 '11 at 3:30
    
Look at the tags, and the title of the question please. You will see that he is using iptables via fwbuilder. –  Zoredache Sep 8 '11 at 3:32
    
Silly me. I'm really not doing good on paying attention today. –  U4iK_HaZe Sep 8 '11 at 3:34
    
Everything is done via DNAT. I'll update the post with the generated iptables rules as fwbuilder spits them out. It's a bit easier than trying to spell out the actual fwbuilder config. –  demonbane Sep 8 '11 at 3:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.