Change destination addresses with iptables

Question

I work with Debian (Linux) and try to change the destination of incoming packets from port 80. Here's the setup: I have my firewall that has two addresses and a web server that has two addresses.

Example:

FireWall

Internal adress: 10.3.3.13
External adresss: 206.167.200.213

Web Server

Internal adress: 10.3.3.6
External adress: 206.167.200.206

I need to redirect incoming connection from port 80 on my firewall to port 80 on the web server.

Here's the command line I'm using in Debian:

iptables -t nat -A PREROUTING -i eth0 -p tcp -d 10.3.3.6 --dport 80 -j DNAT --to 10.3.3.6
iptables -A INPUT -p tcp -m state --state NEW --dport 80 -i eth0 -j ACCEPT

Why doesn't this command work? When I enter the external address of my firewall, the redirect doesn't work and I end up on the default web page of my firewall.

Answer 1

I've found the solution, here's the way to do it:

# Redirect incoming connexion to port 80 on the web server
iptables -t nat -A PREROUTING -p tcp -d $FIREWALL_INT_IP --dport 80 -j DNAT --to-destination $SERVER_INT_IP:80
iptables -t nat -A POSTROUTING -p tcp -d $SERVER_INT_IP -j SNAT --to $FIREWALL_INT_IP
iptables -A FORWARD -p tcp -i eth0 -d $SERVER_INT_IP --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -o eth0 -s $SERVER_INT_IP --sport 80 -j ACCEPT

Answer 2

Try this one

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 10.3.3.13:80 -j REDIRECT --to-port 10.3.3.6:80
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 206.167.200.213:80 -j REDIRECT --to-port 206.167.200.206:80