Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup a

proxy server that handles http and forwards https to the webserver.

Client > Proxy > httpd

I added the rules:

iptables -t nat -I PREROUTING   -i eth1 -p tcp -m tcp --dport 443 -j DNAT --to 172.16.0.webserver:443 
iptables -t nat -I POSTROUTING  -o eth2 -p tcp -m tcp --dport 443 -j SNAT --to 172.16.0.proxyserver
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
iptables -A FORWARD -d 172.16.0.proxyserver/32 -p tcp -m tcp --dport 443 -j ACCEPT 

The TCP/IP triple hand shake appears to work correctly (I'll translate in human-english the dump):

  1. client syn
  2. Proxy sends syn to webserver
  3. Webserver replies with syn+ack
  4. Proxy send back to client syn+ack
  5. Client sends an ACK establishing connection
  6. Proxy sends the ACK to the webserver.
  7. Then all goes wrong, the webserver still sends the syn+ack (on point 3).

Dump:

 187.remote_client_ip.35331 > 172.30.prox01.443: Flags [S], cksum 0xdc43 (correct), seq 4120294192, win 14600, options [mss 1380,sackOK,TS val 2823788935 ecr 0,nop,wscale 7,nop,Unknown Option 1403], length 0
    172.16.prox02.35331 > 172.16.0.websrvr.443: Flags [S], cksum 0x2c28 (correct), seq 4120294192, win 14600, options [mss 1380,sackOK,TS val 2823788935 ecr 0,nop,wscale 7,nop,Unknown Option 1403], length 0
    172.16.0.websrvr.443 > 172.16.prox02.35331: Flags [S.], cksum 0xfc5a (correct), seq 284179605, ack 4120294193, win 14480, options [mss 1460,sackOK,TS val 592958236 ecr 2823788935,nop,wscale 7], length 0
    172.30.prox01.443 > 187.remote_client_ip.35331: Flags [S.], cksum 0xac76 (correct), seq 284179605, ack 4120294193, win 14480, options [mss 1460,sackOK,TS val 592958236 ecr 2823788935,nop,wscale 7], length 0
    187.remote_client_ip.35331 > 172.30.prox01.443: Flags [.], cksum 0x1350 (correct), seq 1, ack 1, win 115, options [nop,nop,TS val 2823788951 ecr 592958236], length 0
    172.16.prox02.35331 > 172.16.0.websrvr.443: Flags [.], cksum 0x6334 (correct), seq 1, ack 1, win 115, options [nop,nop,TS val 2823788951 ecr 592958236], length 0
    172.16.0.websrvr.443 > 172.16.prox02.35331: Flags [S.], cksum 0xfbbe (correct), seq 284179605, ack 4120294193, win 14480, options [mss 1460,sackOK,TS val 592958376 ecr 2823788951,nop,wscale 7], length 0
    172.30.prox01.443 > 187.remote_client_ip.35331: Flags [S.], cksum 0xabda (correct), seq 284179605, ack 4120294193, win 14480, options [mss 1460,sackOK,TS val 592958376 ecr 2823788951,nop,wscale 7], length 0
    172.16.0.websrvr.443 > 172.16.prox02.35331: Flags [S.], cksum 0xfaf6 (correct), seq 284179605, ack 4120294193, win 14480, options [mss 1460,sackOK,TS val 592958576 ecr 2823788951,nop,wscale 7], length 0
    172.30.prox01.443 > 187.remote_client_ip.35331: Flags [S.], cksum 0xab12 (correct), seq 284179605, ack 4120294193, win 14480, options [mss 1460,sackOK,TS val 592958576 ecr 2823788951,nop,wscale 7], length 0

Help is really appreciated!!!!! Thank you in advance

share|improve this question

1 Answer 1

Since you noticed the SYN/ACK gets replayed, it probably means that the webserver never receives the ACK from the proxy. Why ? There is indeed an ESTABLISHED accept on conntrack and the SYN/ACK should make the NAT register the connection appropriately...

My guess is that it is because your two NAT rules are in fact incorrect -- because you are adding the rules to the FILTER table (by default) when the DNAT and SNAT targets are meant to be in the NAT table (obviously). This is denoted on the command line with "-t nat" when adding the rules.

Additionally, if the purpose of the last rule is to allow the proxy server to reach external webservers, what you want is probably to filter by source (-s) rather than destination (-d). You might also want to look into the REDIRECT target to force outbound traffic to use the proxy.

share|improve this answer
    
Hi Fira, thank you for your reply. Sorry i just copied the /etc/sysconfig/iptables and added the command "iptables". This rules are under the *nat label so they are in fact on the nat table. This is a reverse proxy so is ok to just reach one webserver so the -d rule is ok. Thank you again for your help, but this is not the answer i was looking for. –  FarDarkMist Jul 7 '13 at 2:31
    
BTW, without the -t nat the rule fails with ;-) : iptables: Bad rule (does a matching rule exist in that chain?). –  FarDarkMist Jul 7 '13 at 2:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.