Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server that I configured to be a router (Debian 7 Stable). eth0 is hooked up to my cable modem, and eth1 is hooked up to a 24-port switch. DHCP,DNS,Routing,Traffic all work fine. The only thing I can't seem to get working is port forwarding. I want to forward traffic from port 65010 to 172.16.254.10, but it times out. Below is the script that I wrote:

#!/bin/bash
# init

## Flush current configuration:
iptables -F
iptables -t nat -F
iptables -t mangle -F

## Delete current chains:
iptables -X
iptables -t nat -X
iptables -t mangle -X

## Set policy
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

## Allow routing between eth0 and eth1
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth1 -j ACCEPT

## Allow internal SSH:
iptables -A INPUT -s 172.16.254.0/24 -m state --state NEW \
        -p tcp -m multiport --dports 65001,65010 -j ACCEPT

## Allow external SSH:
iptables -A INPUT -p tcp -m multiport --dports 65001,65010 -j ACCEPT

## Allow port forwarding for SSH:
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 65010 \
                      -j DNAT --to-destination 172.16.254.10

## Required for internal host name resolution to function:
iptables -I INPUT -s 172.16.254.0/24 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -s 172.16.254.0/24 -p tcp --dport 53 -j ACCEPT

## Required for Samba to function:
iptables -A INPUT -s 172.16.254.0/24 -m state --state NEW -p tcp \
                   -m multiport --dports 137,138,139,445 -j ACCEPT

iptables-save > /etc/iptables.rules
share|improve this question
    
is net.ipv4.ip_forward set to 1? what is the output of iptables -Lvn? You could make this quesdtion easier to read by removing the lines from your iptables settings which obviously does not affect port forwarding in any way (like iptables -A INPUT -s 172.16.254.0/24 -m state --state NEW -p tcp -m multiport --dports 137,138,139,445 -j ACCEPTor iptables-save > /etc/iptables.rules –  Petter H Jun 18 '13 at 17:01
    
Yes, net.ipv4.ip_forward is set to 1. The output of iptables -Lvn is: "No chain/target/match by that name." I included the entire script because for all I know, anything on there could be stopping it. –  jlacroix82 Jun 18 '13 at 17:05
    
I see the rule that performs the nat, but where is the rule that actually permits the traffic? A rule on the nat table will modify the packet, but that does not imply the packet will actually be accepted/forwarded. –  Zoredache Jun 18 '13 at 17:10
    
Unless I'm mistaken, the following should be allowing it, shouldn't it: iptables -A INPUT -p tcp -m multiport --dports 65001,65010 -j ACCEPT –  jlacroix82 Jun 18 '13 at 17:25

1 Answer 1

Try using:

iptables -A FORWARD -i eth0 -p tcp --dport 65010 -d 172.16.254.10 -j ACCEPT

On the other hand, you are not setting any default policies to DROP nor added any "-j DROP" rules in any chains to catch unmatched traffic, so everything is permitted.

Lastly you might want to add the destination's port number in the DNAT rule:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 65010 -j DNAT \
                                --to-destination 172.16.254.10:65010

Try running something like tcpdump or wireshark to make sure that packets are forwarded properly to the internal destination.

share|improve this answer
    
Thanks. You say that I'm not setting any default policies therefore everything is permitted, but if that is the case, then why am I not able to access anything at all until I allow it? For example, just now I realized that I cannot ping internal machines so I'm trying to figure out what firewall will allow internal ping (but not allow pinging from the WAN). –  jlacroix82 Jun 18 '13 at 19:02
    
iptables -S && iptables -nvxL will let you know what is the default policy. Possibly you run this script after something else already set the default policies to "DROP" –  jijix Jun 18 '13 at 19:15
    
I ran the commands: pastebin.com/JsuyBeAh Should I be concerned or change anything in my policy? –  jlacroix82 Jun 18 '13 at 19:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.