Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to set up port forwarding with iptables.

I've read several stuff (including here on serverfault) but every example I try fails.

I have a Debian GNU/Linux box with a globally routed IP address, say 1.2.3.4. I also have an internal network 192.168.15.0/24, which has one host (192.168.15.2) in it.

I simply want port 2200 on 1.2.3.4 forwarded to 192.168.15.2:22, so this is what I've done:

iptables -A PREROUTING -t nat -p tcp --dport 2200 -j DNAT --to 192.168.15.2:22
iptables -A INPUT -p tcp -m state --state NEW --dport 2200 -j ACCEPT

However, this does not work. If i try to ssh to 1.2.3.4:2200, I get "Connection refused".

Trying for over 3hrs now and I'm feeling like I've tried everything and there must be something wrong.

IP forwarding is on:

root@1.2.3.4:~# cat /proc/sys/net/ipv4/ip_forward
1
share|improve this question
    
Is that your entire ruleset? You also need to allow ESTABLISHED,RELATED packets, otherwise only the first packet of the TCP handshake will ever make it through. –  Ansgar Wiechers Sep 10 '12 at 17:46
    
Your description of your network is a bit confusing. The address 192.168.0.2 is not within the 192.168.15.0/24 network. What is the address of the inside interface of the firewall? –  Zoredache Sep 10 '12 at 18:28
    
Zoredache: Sorry. I meant 192.168.15.2, not 192.168.0.2 –  Daniel Sep 10 '12 at 18:36
add comment

1 Answer

A couple things.

First since the destination nat is performed on the PREROUTING you need to make sure you build any of your rules on the filter table using the address after the address translation has been performed. PREROUTING is processes before the FILTER table. So you rule that permits 2200 isn't doing anything useful since since it doesn't have a destination port of 2200 by when it hits the filter table, and instead it has been translated to port 22 by your NAT rule.

The other part I am less certain about since you haven't given a good description of your network. Unless I am miss-understanding your network setup, then I believe 192.168.15.2 is not an address on the firewall. I bring this up since you are trying to add a rule to the INPUT chain. The INPUT chain is used for packets being sent to the firewall system itself, and doesn't get visited when the packets are being routed between interfaces from one network to another. I suspect that you should be adding a rule to the FORWARD chain instead.

share|improve this answer
    
For clarification, the network 192.168.15.0/24 is a network I use on that host for virtual machines (KVM). And, the INPUT chain's default action is ACCEPT. Using tcpdump I'm able to see the SSH packet coming on the WAN interface –  Daniel Sep 10 '12 at 18:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.