Here's my scenario:
Setup
There are 3 machines:
A
: on the internet : has ip (a.a.a.a
), has port pa
open
B
: my server / gateway : has ip (b.b.b.b
), has port pb
open
C
: on the internet : has ip (c.c.c.c
), has port pc
open
Constraints
The owner of machine A
offers a service via port pa
that must be accessed on machine C
via port pc
. The problem is, the owner of A
can only allow to directly connect with my server, machine B
on port pb
.
Note that, A
and C
are on the internet, so in effect, I have to act as a gateway between two machines on the internet (the literature I've found in most firewall docs concerns acting as a gateway between the internet and your local network).
Extras
Machine B
is running OpenSuse 11.4
Requirements
My task is to make sure I give machine C
the service offered by A
via my server B
, in such a way that traffic from A:pa
ends up on C:pc
and traffic from C:pc
ends up on A:pa
.
So, how can I achieve this, say using iptables
or another Linux / Unix utility? Is it even possible?
Hypothetical Solution:
Here's an Idea I have in mind, but am not sure it's legit or makes sense:
iptables -t nat -A PREROUTING -p tcp --source a.a.a.a --source-port pa \
--destination b.b.b.b --destination-port pb -j DNAT --to-destination c.c.c.c:pc
and
iptables -t nat -A PREROUTING -p tcp --source c.c.c.c --source-port pc \
--destination b.b.b.b --destination-port pb -j DNAT --to-destination a.a.a.a:pa