Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Edit: resolved using info I found here http://serverfault.com/questions/27221/iptables-port-forwarding-on-debian

I'm trying to set up svn on my existing web server, and for some reason the same technique I use for forwarding to web servers through my router isn't working for the different port for svn. I wrote the following simple shell script to add a server

#!/bin/bash
#!/bin/sh

ROOT_UID=0

if [ $UID -ne $ROOT_UID ]
then
    echo "You must be root."
    exit 87
else
    echo "Adding FORWARD entry..."
    iptables -I FORWARD 5 -p tcp -i eth1 -d $1 --dport $3 -j ACCEPT
    echo "Adding PREROUTING entries..."
    iptables -t nat -I PREROUTING 1 -p tcp -i eth1 --dport $3 -j DNAT --to $1:$3
    iptables -t nat -I PREROUTING 2 -p tcp -i ath0 -d $2 -j DNAT --to $1:$3
    iptables -t nat -I PREROUTING 3 -p tcp -i eth2 -d $2 -j DNAT --to $1:$3
    echo "Adding POSTROUTING entry..."
    iptables -t nat -A POSTROUTING -p tcp -o eth2 -d $1 --dport $3 -j MASQUERADE
    echo "Done"
    exit 0
fi

Where $1 is the internal IP of the server, $2 is the external host name, and $3 is the port. I've also tried opening the port on INPUT as a port scan reveals that the port I'm trying to used is closed after running the above script.

Any help would be appreciated.

share|improve this question

1 Answer 1

A number of suggestions:

1) Use "-A PREROUTING" if you're going to add things to the bottom of the table. If you want to add a bunch of things to the top, drop the number. By default -I uses 1. This saves you having to renumber your lines if you add additional lines.

2) You have both /bin/bash and /bin/sh at the top. Drop the /bin/sh. It won't do anything having both, but it might be confusing.

3) Negate your check for root and take the body of the script out of the if statement. This makes the code cleaner. I'd probably also scrap the ROOT_UID variable too, as you only use it once, and the condition and error message make it clear what you're checking.

Finally, and possibly most importantly, don't write iptables rules by hand. Use something like shorewall and let that deal with the complexity. You could replace your script with something like:

DNS/DNAT       net             loc:10.0.0.9    -    -      -   83.100.256.28

Which means redirect any DNS traffic from the internet zone originally to 83.100.256.28 to 10.0.0.9 on the local network. It will add all the iptables rules you need.

share|improve this answer
    
Thanks, but this gets used maybe once a month, max - I wasn't really looking for tips on improving the script. –  Alex S Aug 10 '09 at 7:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.