0

I've got a server running Fedora 15. My end goal is to be able to forward any protocol over random port numbers (specified via iptables rules.) Let's say, for the time being, I want to forward port 12345 to a webserver inside the network. We'll say this webserver is 192.168.0.10:80 .

After adding a rule to iptables to open the port like so:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 12345 -j ACCEPT

I restart iptables, and run:

nmap -p 12000-13000 localhost

nmap doesn't show that the port is open/closed. I then define the port with semanage like so:

semanage port -a -t http_port_t -p tcp 12345

nmap still doesn't see the port.

If I then disable selinux completely, nmap shows the port as "closed".

I can't seem to find a way to open the port. I've been scouring the web for days, and i've not been able to solve the problem. I can provide any other piece of config data you'd like. Any suggestions?

EDIT: Added output of iptables -L -n -v:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  641 3038K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
   12   720 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
    5   261 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:80 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:12345 
    1    52 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT 663 packets, 3044K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:12345
1
  • What happens if you also do #service iptables stop ? Apr 20, 2012 at 15:36

2 Answers 2

1

If you want to FORWARD traffic, you use the FORWARD chain, not the INPUT chain.

The INPUT chain will apply only to packets actually destined to the firewall (e.g., having a destination address of one of the firewall's addresses).

Secondly, remember that FORWARDing traffic means that no manipulation will be performed on the packet itself. So, the destination server must have port 12345 open.

(If you want to manipulate the source/destination address and/or port, use SNAT/DNAT)

0

I don't know this for sure, but I suspect the problem is that your -A INPUT ... is adding your permit after some blanket pre-existing DROP rule. We'd need to see the output of iptables -L -n -v after you've added your rule to be sure; if you want to paste that into your question above, it would be helpful.

iptables rule processing is first-dispositive-match wins; that is, it goes through the rule in order, and the first one that matches your packet and disposes of it, will have the final say for that packet.

So, in terse metacode, it doesn't make any sense to have a ruleset like

permit any any port 80
deny any any
permit any any port 12345

Line 2 will match a packet intended for port 12345 - as it matches any packet not intended for port 80 - and denies it. The poor packet will never get as far as line 3's permit.

My apologies if you already know all this, and it's not the issue. It would still be helpful to see the iptables output, to explore further.

Edit: OK, it looks like rules ordering isn't the issue. What makes you think it's not working? What happens on that server when you do a telnet localhost 12345?

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .