Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

im trying to open some local ports (LAN) and then re-direct them to another server (WAN) using iptables.

Here is my config:

#WAN
allow-hotplug eth1
auto eth1
iface eth1 inet static
#Tarjeta red WAN
address 192.168.2.2
gateway 192.168.2.1 
netmask 255.255.255.0

#LAN
allow-hotplug eth0 
auto eth0
iface eth0 inet static
address 192.168.16.6
netmask 255.255.255.0
network 192.168.16.0 
broadcast 192.168.16.255

I try this:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 110 -j DNAT --to 200.40.30.218:110
iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 200.40.30.218 --dport 110 -j ACCEPT 

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 25 -j DNAT --to 200.40.30.218:25
iptables -A FORWARD -p tcp -i eth0 -o ethq -d 200.40.30.218 --dport 25 -j ACCEPT

but, it did not work. i also try changeing eth0 to eth1 (and eth1 to eth0) but nothing happened.

Starting Nmap 5.00 ( http://nmap.org ) at 2011-10-03 14:44 UYST
Interesting ports on 192.168.16.6:
Not shown: 997 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
111/tcp  open  rpcbind
8080/tcp open  http-proxy

Im running debian. Can u guys help me to check what is happening?

edit: IPTABLES-SAVE

# Generated by iptables-save v1.4.8 on Mon Oct  3 15:43:14 2011
*mangle
:PREROUTING ACCEPT [139993:77867651]
:INPUT ACCEPT [139385:77761761]
:FORWARD ACCEPT [186:12071]
:OUTPUT ACCEPT [173556:74341650]
:POSTROUTING ACCEPT [173734:74352988]
COMMIT
# Completed on Mon Oct  3 15:43:14 2011
# Generated by iptables-save v1.4.8 on Mon Oct  3 15:43:14 2011
*nat
:PREROUTING ACCEPT [1649:190626]
:POSTROUTING ACCEPT [6729:339646]
:OUTPUT ACCEPT [6697:337660]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 110 -j DNAT --to-destination 200.40.30.218:110 
-A PREROUTING -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 200.40.30.218:25 
COMMIT
# Completed on Mon Oct  3 15:43:14 2011
# Generated by iptables-save v1.4.8 on Mon Oct  3 15:43:14 2011
*filter
:INPUT ACCEPT [138307:77066136]
:FORWARD ACCEPT [168:11207]
:OUTPUT ACCEPT [172288:73655708]
-A FORWARD -d 200.40.30.218/32 -i eth0 -o eth1 -p tcp -m tcp --dport 110 -j ACCEPT 
-A FORWARD -d 200.40.30.218/32 -i eth0 -o ethq -p tcp -m tcp --dport 25 -j ACCEPT 
COMMIT
# Completed on Mon Oct  3 15:43:14 2011

Regards

share|improve this question
    
Trying to use iptables to NAT something that to leave the same interface it was received on is a big PITA. Search for iptables hairpin –  Zoredache Oct 3 '11 at 17:14
    
I think I know what it is, but to confirm, can we have the whole iptables ruleset posted? –  Rilindo Oct 3 '11 at 17:20
    
redy, i dumped the iptables config. –  Emmet Brown Oct 3 '11 at 17:58
    
BTW, is 200.40.30.218 is a real address or an example address? –  Rilindo Oct 3 '11 at 18:16
add comment

1 Answer 1

up vote 2 down vote accepted

it looks like MASQUERADING is not setup. Add the following before the first PREROUTING STATEMENT

-A POSTROUTING -o eth0 -j MASQUERADE

So it would be something like:

-A POSTROUTING -o eth0 -j MASQUERADE
-A PREROUTING -i eth0 -p tcp -m tcp --dport 110 -j DNAT --to-destination 200.40.30.218:110 
-A PREROUTING -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 200.40.30.218:25 

Also, make sure that IP forwarding is enabled. ou can set it dynamically with either:

sysctl -w net.ipv4.conf.all.forwarding =1

Or:

echo “1” > /proc/sys/net/ipv4/ip_forward

To change it permanently (which is what you want), add or change the net.ipv4.conf.all.forwarding value in /etc/sysctl.conf to:

net.ipv4.ip_forward = 1 

The last one is I think how you would do it on Red Hat, so if you don't have that file, you can add the first command in /etc/rc.local or look up the Ubuntu way of making the change.

Also, you last FORWARD statement appears to be error. It looks like it is supposed to be:

-A FORWARD -d 200.40.30.218/32 -i eth1 -o eth0 -p tcp -m tcp --dport 110 -j ACCEPT 
-A FORWARD -d 200.40.30.218/32 -i eth1 -o eth0 -p tcp -m tcp --dport 25 -j ACCEPT

I think that is how you get it working. I re-read the post and you want to forward inbound traffic to servers on the WAN, so I made the above changes to account for that (it a little confusing, because you usually go from WAN -> LAN with NAT, not the other way around).

But the important thing is that you need to ensure that IP forwarding is enabled as well as MASQUERADING.

share|improve this answer
    
I got an error message: anubis:~# iptables -A POSTROUTING -o eth0 -j MASQUERADE iptables: No chain/target/match by that name. –  Emmet Brown Oct 3 '11 at 18:30
    
You probably need to edit the rules file directly to add that in. Or you can do this: iptables -t nat -I POSTROUTING 1 -o eth0 -j MASQUERADE (which should insert the result into the first line) and then save the iptables ruleset. –  Rilindo Oct 3 '11 at 18:43
    
done, nothing happened :( Starting Nmap 5.00 ( nmap.org ) at 2011-10-03 17:44 UYST Interesting ports on 192.168.16.6: Not shown: 997 closed ports PORT STATE SERVICE 22/tcp open ssh 111/tcp open rpcbind 8080/tcp open http-proxy –  Emmet Brown Oct 3 '11 at 19:58
    
Can you confirm that the ports are open for the servers that you forwarding the ports to - running a nmap against them? –  Rilindo Oct 3 '11 at 20:10
1  
We will need to chat, but I am not where I could do it yet. In the interim, assuming that nobody else responds, you can look at my article sometime back back - monzell.com/post/10615561454/… - its for red hat, but if you get past the GUI part, it may be of help to you. –  Rilindo Oct 3 '11 at 20:28
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.