Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 3 Linux Systems A, B and C. A is a TCP Client and sends a message to TCP Server on C. A can see only the external IP of B which is at wlan0 interface, 192.168.0.3

------------------                ---------------------          --------------------------

  System A                         System B                      System C
  192.168.0.5 wlan0     <----->    192.168.0.3 wlan0                  
                                   192.168.61.73 eth0    <--->   192.168.61.81 eth0
  TCP Client                                                     TCP Server on 192.168.61.81
------------------               ----------------------          -------------------------

The TCP Client sends message to 192.168.0.3.

This should be redirected to the TCP Server running on 192.168.61.81 at Port 8036 of System C (through the eth0 interface of B).

Therefore, I wrote the following ip table rules and then I start the Server on C and send a message from TCP Client on A. I can see the packets on System B from A on wlan0 but they never get forwarded. System B seems to be receiving SYN packets from A but dropping them(see logs).

Here is what I did on System B:

#Enable IP Forwarding for NAT
echo "1" > /proc/sys/net/ipv4/ip_forward

#Flush all iptable chains and start afresh
sudo iptables -F


#Forwarding rules

sudo iptables -A PREROUTING  -p tcp -m tcp -d 192.168.0.3 --dport 8036 -j DNAT --to-destination 192.168.61.81:8036

sudo iptables -A FORWARD -m state -p tcp -d 192.168.61.81 --dport 8036 --state NEW,ESTABLISHED,RELATED -j ACCEPT

sudo iptables -t nat -A POSTROUTING -p tcp -m tcp -s 192.168.61.81 --sport 8036 -j SNAT --to-source 192.168.0.3


#Enable logging
sudo iptables -A INPUT -j LOG --log-prefix INPUT
sudo iptables -A OUTPUT -j LOG --log-prefix OUTPUT
sudo iptables -A FORWARD -j LOG --log-prefix FORWARD

sudo iptables -A INPUT -j LOG --log-prefix 'drop:'
sudo iptables -A OUTPUT -j LOG --log-prefix 'drop:'
sudo iptables -A FORWARD -j LOG --log-prefix 'drop:'

tail -F /var/log/messages

System B Logs from /var/log/messages:(SYN Packets being dropped)

May  2 11:53:17 my-laptop kernel: [42879.905449] FORWARDIN=wlan0 OUT=eth0 SRC=192.168.0.5 DST=192.168.61.81 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=30394 DF PROTO=TCP SPT=40582 DPT=8036 WINDOW=5840 RES=0x00 SYN URGP=0 

May  2 11:53:17 my-laptop kernel: [42879.905459] drop:IN=wlan0 OUT=eth0 SRC=192.168.0.5 DST=192.168.61.81 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=30394 DF PROTO=TCP SPT=40582 DPT=8036 WINDOW=5840 RES=0x00 SYN URGP=0 

Kernel IP routing table on System B:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.61.0    *               255.255.255.0   U     0      0        0 eth0
default         localhost       0.0.0.0         UG    0      0        0 eth0

Please help.

UPDATED:

sudo iptables -L -n -v
Chain INPUT (policy ACCEPT 39844 packets, 25M bytes)
 pkts bytes target     prot opt in     out     source               destination         
26926   10M LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 
12866 8559K LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `INPUT' 
12862 8558K LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `drop:' 

Chain FORWARD (policy ACCEPT 43 packets, 2580 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   79  4740 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.61.81       state NEW,RELATED,ESTABLISHED tcp dpt:8036 
   16   960 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `FORWARD' 
   16   960 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `drop:' 

Chain OUTPUT (policy ACCEPT 36130 packets, 4943K bytes)
 pkts bytes target     prot opt in     out     source               destination         
27863 4093K LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 
14035 2296K LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `OUTPUT' 
14034 2296K LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `drop:' 


 sudo iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 252 packets, 63782 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    8   480 DNAT       tcp  --  *      *       0.0.0.0/0            192.168.0.3         tcp dpt:8036 to:192.168.61.81:8036 
  236 59206 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 

Chain OUTPUT (policy ACCEPT 3098 packets, 208K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 3121 packets, 210K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 SNAT       tcp  --  *      *       192.168.61.81        0.0.0.0/0           tcp spt:8036 to:192.168.0.3 
 2975  199K LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 
share|improve this question
    
Please post your entire ruleset, ie the outputs of iptables -L -n -v and iptables -t nat -L -n -v. Because rules are position-dependent, showing us what rules you've added without showing what you've added them to isn't much help. –  MadHatter May 2 '12 at 12:34
    
Probably a typo in your question, but it should be echo "1" > /proc/sys/net/ipv4/ip_forward (note the direction of the >) –  SmallClanger May 2 '12 at 12:38
    
@SmallClanger: thanks corrected the typo –  user907810 May 2 '12 at 13:45
    
Next step: Set up three tcpdump or tshark sessions on B and C with tcpdump -qtln -i <interface> port 8036 where <interface> is the two adaptors on system B and the interface on C, respectively. Use this to how far the TCP handshaking is making it through the system. Also, you don't need to explicitly SNAT the return traffic. netfilter should handle that for you. –  SmallClanger May 2 '12 at 14:47
    
Hi SmallClanger, I just have another question. What kind of routes should I add in my "route" command to allow this forwarding? –  user907810 May 3 '12 at 10:53
show 3 more comments

2 Answers

I found that I had to set the default gw on System B and System C as 192.168.0.3, otherwise by default 192.168.0.1(the WLAN router) was set as the default route.

Once I set the default routes, everything worked like a charm :)

share|improve this answer
add comment

Weird configuration for a simple configuration I'd say, no need to mess so much with iptables, snat and so on. After configuring B for ip fowarding, it should have been enough to set static routes in A and C to reach each other's networks through B. Or, if you already had routers/gateways in the local networks, you could set the static route straight in them (though less efficent, as communication packets would make 2 more hops - to the router and then to B)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.