Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am a newbie to iptables. Sorry for the basic question. I am trying to connect to a Windows Machine using Microsoft's "Remote Desktop Protocol" This service uses TCP Port 3389. My Linux server is my firewall and we use iptables.

My Linux server is at 192.168.0.1 My windows machine is at 192.168.0.55

I cannot RDP so I assume that there is an error in the tables. or perhaps, I have things in the wrong order. Here is the complete iptables file:

:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.0.0/24 -o em1 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT  -i p1p1 -s 192.168.0.0/24 -j ACCEPT
-A OUTPUT -o p1p1 -d 192.168.0.0/24 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2022 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 7071 -j DROP
-A INPUT -p tcp -m tcp --dport 7071 -j DROP
-A INPUT -p tcp -m tcp --sport 7071 -s 192.168.0.0/24 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 7071 -d 192.168.0.0/24 -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A INPUT -p udp -m udp --sport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 25 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -p udp -m udp --sport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 110 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 143 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 465 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 993 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 3306 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 8000 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 1194 -j ACCEPT
-A OUTPUT -p tcp --sport 1194 -j ACCEPT
-A INPUT -p udp --dport 1194 -j ACCEPT
-A OUTPUT -p udp --sport 1194 -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A FORWARD -i tun0 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -d 192.168.0.1 --dport 3389 -j DNAT --to-destination 192.168.0.55
COMMIT

Any insight into what I did wrong would be really appreciated. Thanks in advance

share|improve this question
    
Where are you trying to connect from? Some external IP? What's the name of the linux machines external and internal interface? –  etagenklo Nov 27 '13 at 14:59
1  
This firewall does not actually block anything! –  Michael Hampton Nov 27 '13 at 17:12

1 Answer 1

up vote 0 down vote accepted
iptables -t nat -A PREROUTING -p tcp -d 192.168.0.1 --dport 3389 -j DNAT --to-destination 192.168.0.55

should be:

COMMIT
*nat
-A PREROUTING -p tcp -d 192.168.0.1 --dport 3389 -j DNAT --to-destination 192.168.0.55

You didn't notice an error when you loaded these rules?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.