Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm facing the problem, that my iptables rules aren't working anymore after I changed OS from Ubuntu 8.04 to Debian Squeeze.

I'm trying to do a Port Forwarding by

iptables -t nat -A PREROUTING -d $extip -i eth0 -p tcp -m tcp --dport 5777 -j DNAT --to-destination 192.168.10.169:5777

/proc/sys/net/ipv4/ip_forwarding is set

All policies are set to ACCEPT

192.168.10.169 is in FORWARD chain

tcpdump output:

IP some_ip.33517 > ext_ip.5777: Flags [S], seq 3521672809, win 14600, options [mss 1450,sackOK,TS val 1691129923 ecr 0,nop,wscale 7], length 0
IP ext_ip.5777 > some_ip.33517: Flags [R.], seq 0, ack 3521672810, win 0, length 0

As you can see, there is a RST sent after SYN. I have no clue why this is happening.

I hope someone can help me. Thanks in advance.

share|improve this question
    
What does your nat table currently look like? And, is the service you intend to connect to actually running? –  Michael Hampton Sep 25 '13 at 21:26
    
Just the PREOTUING line and iptables -A POSTROUTING -s 192.168.10.169 -o eth0 -j SNAT --to-source ext_ip Yes, the service is running. I can connect from the firewall box –  Conrad Sep 25 '13 at 21:57
    
Which interface did you do your tcpdump on? In the case of NAT you might need to do something like tcpdump -qni any port 5777. –  Zoredache Sep 25 '13 at 23:18
    
Yep, I did tcpdump -i any –  Conrad Sep 25 '13 at 23:27
    
Is eth0 actually the "outside" interface? –  Falcon Momot Sep 26 '13 at 1:32

1 Answer 1

I finally solved the problem myself. After hours of trying almost everything, it was the interface parameter.

so this worked on the old machine

iptables -t nat -A PREROUTING -d $extip -i eth0 -p tcp -m tcp --dport 5777 -j DNAT --to-destination 192.168.10.169:5777

but on the new machine it works only without -i eth0, even though the interface have the same names

iptables -t nat -A PREROUTING -d $extip -p tcp -m tcp --dport 5777 -j DNAT --to-destination 192.168.10.169:5777

Thanks to everyone who tried to help.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.