3

Here's my scenario:

Setup

There are 3 machines:

A: on the internet : has ip (a.a.a.a), has port pa open

B: my server / gateway : has ip (b.b.b.b), has port pb open

C: on the internet : has ip (c.c.c.c), has port pc open

Constraints

The owner of machine A offers a service via port pa that must be accessed on machine C via port pc. The problem is, the owner of A can only allow to directly connect with my server, machine B on port pb.

Note that, A and C are on the internet, so in effect, I have to act as a gateway between two machines on the internet (the literature I've found in most firewall docs concerns acting as a gateway between the internet and your local network).

Extras

Machine B is running OpenSuse 11.4

Requirements

My task is to make sure I give machine C the service offered by A via my server B, in such a way that traffic from A:pa ends up on C:pc and traffic from C:pc ends up on A:pa.

So, how can I achieve this, say using iptables or another Linux / Unix utility? Is it even possible?

Hypothetical Solution:

Here's an Idea I have in mind, but am not sure it's legit or makes sense:

iptables -t nat -A PREROUTING -p tcp --source a.a.a.a --source-port pa \
--destination b.b.b.b --destination-port pb -j DNAT --to-destination c.c.c.c:pc

and 

iptables -t nat -A PREROUTING -p tcp --source c.c.c.c --source-port pc \
--destination b.b.b.b --destination-port pb -j DNAT --to-destination a.a.a.a:pa
Improve this question

1 Answer 1

Reset to default
1

I'm assuming that C is connecting to A:pa (it's not quite clear). You need to perform both DNAT and SNAT on B for these connections from C:

iptables -t nat -A PREROUTING -p tcp -s c.c.c.c -d b.b.b.b --dport pb -j DNAT --to-destination a.a.a.a:pa
iptables -t nat -A POSTROUTING -p tcp -d a.a.a.a --dport pa -j MASQUERADE
Improve this answer
3
  • Thanks, to make it clearer, surely C wants to connect to A:pa, but can't do it directly, that's why C must connect to B:pb and B:pb acts as a proxy for A:pa. The same applies to A:pa wanting to talk to C:pc.
    – JWL
    Mar 15, 2013 at 5:54
  • @nemesisfixx Do you mean that A also needs to connect to C:pc (as in make a TCP connection), or just that packets need to get back from A to C for the C->A connection?
    – mgorven
    Mar 15, 2013 at 16:29
  • packets from A need to get to C, and packets from C need to get to A. Only that a direct connection is not possible, thus B must provide the gateway.
    – JWL
    Mar 15, 2013 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .