3

I'm almost desperate... I've been reading for about 2 days iptables forwarding examples and I cannot do a simple port forwarding. I got 2 machines on different networks. server1 (S1 with ip 195.21.2.41) is at my house and server2 (s2 with ip 10.234.141.126) is at Amazon EC2.

I need to forward all the traffic that goes to s2 to s1. I tried this:

flushing all rules, activate kernel parameter to forward, add a postrouting and prerouting rule

iptables -F -t nat
iptables -F
echo 1 > /proc/sys/net/ipv4/ip_forward 
iptables -t nat -A POSTROUTING -d 195.21.2.41 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -d 10.234.141.126 -p tcp --dport 80 -j DNAT --to 195.21.2.41

optionally i also added:

iptables -A FORWARD -p tcp -i eth0 -d 195.21.2.41 --dport 80 -j ACCEPT

Then i tried:

telnet 10.234.141.126 80

But didn't work. Why the hell this isnt working?

UPDATE: take a look at some tests:

[root@ip-10-234-141-216 ~]# telnet 195.21.2.41 80
Trying 195.21.2.41...
Connected to 195.21.2.41.
Escape character is '^]'.
[root@ip-10-234-141-216 ~]# iptables -F -t nat
[root@ip-10-234-141-216 ~]# iptables -F
[root@ip-10-234-141-216 ~]# echo 1 > /proc/sys/net/ipv4/ip_forward 
[root@ip-10-234-141-216 ~]# /sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp -d 10.234.141.126 --dport 80 -j DNAT --to-destination 195.21.2.41
[root@ip-10-234-141-226 ~]# /sbin/iptables -t nat -A POSTROUTING -j MASQUERADE
[root@ip-10-234-141-216 ~]# /sbin/iptables -A FORWARD -i eth0 -p tcp --dport 80 -j ACCEPT
[root@ip-10-234-141-216 ~]# 
[root@ip-10-234-141-216 ~]# telnet 10.234.141.126 80
Trying 10.234.141.126...
telnet: connect to address 10.234.141.126: Connection refused

UPDATE 2 route output:

[root@ip-10-234-141-216 ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.234.141.0    0.0.0.0         255.255.254.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
0.0.0.0         10.234.141.1    0.0.0.0         UG    0      0        0 eth0
10
  • 1
    I'm not much of a system administrator, but for what its worth, have you considered firing up wireshark? You might be able to figure out exactly --where-- your packets are being dropped?
    – user1106176
    Dec 19, 2011 at 15:24
  • iptables itself does not forward—that is taken care of by the routing engine instead. Don't confuse that with NAT, either.
    – jørgensen
    Dec 19, 2011 at 15:37
  • 1
    Why are you trying to do this? Why not set up a reverse proxy on the amazon host? Or something that does an http redirect?
    – Zoredache
    Dec 19, 2011 at 16:18
  • @jørgensen iptables can do forwarding. That being said, it might not be the best solution as Zoredache suggested but perhaps OP does not have any choice. Dec 19, 2011 at 16:37
  • The kind of traffic I am trying to forward is not http traffic. so i guess a reverse proxy will not work.
    – Fakada
    Dec 19, 2011 at 16:41

5 Answers 5

3

If you just need to redirect all incoming traffic to a specified port forwarded to your another machine try rinetd instead of iptables. It's a traffic redirection server.

3
  • Awesome! Works perfectly cause I only want to redirect traffic :) at least the connection is made and I get the reply :)
    – Fakada
    Dec 20, 2011 at 11:11
  • Big negative for rinetd version 0.62: the pid file is never created in /var/run/rinetd.pid, even if I add a pidlogfile statement to the config file. I strace the startup of it, and I never see it creating the file.
    – e40
    Aug 3, 2013 at 20:31
  • NOTE: this is for the RPM I found in the Nux Misc repo. Building from source doesn't have this problem, even though both are supposed to be 0.62.
    – e40
    Aug 3, 2013 at 21:21
2

I am currently having the same issue. I have resolved it by

echo 1 >| /proc/sys/net/ipv4/ip_forward
iptables -t nat -A  PREROUTING -p tcp -d 47.168.137.12 --dport 8081 -j DNAT --to 47.168.137.11:8086
iptables -t nat  -A POSTROUTING -j MASQUERADE
1
  • 1
    That saved my day. A million thanks!!!
    – AhmedWas
    Mar 13 at 21:58
2

Why not just use iptables?

iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 3306 -j DNAT --to 192.168.7.101:3306

One off jobs:

iptables -t nat -A POSTROUTING -j MASQUERADE
echo "1" > /proc/sys/net/ipv4/ip_forward
sysctl net.ipv4.ip_forward=1
1

it will not work because you telnet from the same router machine It should working properly from any machine that use this route machine as a next hope or if you need just to make those work you can add this rule

/sbin/iptables -t nat -A OUTPUT -i eth0 -p tcp -d 10.234.141.126 --dport 80 -j DNAT --to-destination 195.21.2.41
1
  • Doesn't work: iptables v1.4.7: Can't use -i with OUTPUT
    – e40
    Aug 3, 2013 at 20:30
0

Your rules look good to me except that you are using --to instead of --to-destination. Might be that you are using a different version of iptables but according to man 8 iptables (v.1.4.7):

   --to offset
          Set the offset from which it starts looking for any matching. If not passed, default is the packet size.

Then in the DNAT section:

   --to-destination [ipaddr][-ipaddr][:port[-port]]
          which can specify a single new destination IP address, an inclusive range of IP addresses, and optionally, a port range  (which  is  only
          valid  if the rule also specifies -p tcp or -p udp).  If no port range is specified, then the destination port will never be modified. If
          no IP address is specified then only the destination port will be modified.

          In Kernels up to 2.6.10 you can add several --to-destination options. For those  kernels,  if  you  specify  more  than  one  destination
          address, either via an address range or multiple --to-destination options, a simple round-robin (one after another in cycle) load balanc-
          ing takes place between these addresses.  Later Kernels (>= 2.6.11-rc1) don’t have the ability to NAT to multiple ranges anymore.

This is what I would try:

/sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp -d 10.234.141.126 --dport 80 -j DNAT --to-destination 195.21.2.41
/sbin/iptables -t nat -A POSTROUTING -j MASQUERADE
/sbin/iptables -A FORWARD -i eth0 -p tcp --dport 80 -j ACCEPT

I'd also try to telnet to your destination from 10.234.141.126 just to make sure that a firewall there is not preventing the connection.

telnet 195.21.2.41 80
6
  • telnet works ok from s2 to s1
    – Fakada
    Dec 19, 2011 at 16:42
  • Did you man iptables to confirm the switches? I added the way I'd do the rules. Of course, make sure you iptables -F -t nat as you were doing before and also iptables -L FORWARD to make sure nothing supersedes the FORWARD rule. Dec 19, 2011 at 16:55
  • take a look at my update please. Did you tried to do that on your machine? Thanks anyway
    – Fakada
    Dec 19, 2011 at 21:12
  • Yuppers. Verified on my machine and it worked. Dec 19, 2011 at 21:41
  • really? what the hell :( what OS distribution are you using?
    – Fakada
    Dec 19, 2011 at 23:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .