Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to build a router from ubuntu 12.04. What I am trying to do is, by using 1 public IP (100.0.0.100) and I tons of local ips like 10.0.0.0/16, to map each port to one ip like;

100.0.0.100:5678 <-> 10.0.0.5:80 // http://100.0.0.100:5678 should bring me web server on 10.0.0.5
100.0.0.100:6789 <-> 10.0.0.6:8080
100.0.0.100:7890 <-> 10.0.0.7:22
....

What I did is; I build the NAT rules like below (Assuming that this accepts packets from eth0 and forward it through eth1)

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
iptables --append FORWARD --in-interface eth0 -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables-save
service ufw restart

And then tried these commands;

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j DNAT --to 213.128.88.2:80
iptables -A INPUT -p tcp -m state --state NEW --dport 80 -i eth0 -j ACCEPT

I Tested is by trying to open the web site with the IP 192.168.0.36 (Which is the Ubuntu Server IP)

Additionally; Output of "iptables -t nat -L" is;

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere             tcp dpt:http to:213.128.88.2:80

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

What I tried is to iptables with various nat rules but I cannot achieve this. How can I achieve this ?

Thanks in advance, Baris

share|improve this question
    
What doesn't work? What exactly did you use for rules. What errors do you get? Add more details. –  Zoredache Jan 7 at 17:42
    
Zoredache, you are right, sorry for misinformation. I am now adding the new info. –  Harun Baris Bulut Jan 7 at 18:15
add comment

1 Answer

up vote 0 down vote accepted

Assuming you have the NAT itself set up and working (there are about a million tutorials for that), port forwarding is just a normal rule, eg

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 5678 -j DNAT --to 10.0.0.5:80
iptables -A INPUT -p tcp -m state --state NEW --dport 5678 -i eth0 -j ACCEPT

Lather, rinse, and repeat for every port you want to forward somewhere.

To set up the NAT itself, do something like this:

ifconfig eth1 10.0.0.1
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

(Assuming eth1 is your local network and eth0 is your internet connection.) Then add the port forwarding commands.

share|improve this answer
    
Hi Bandrami, I did what you told me but it still does not work, maybe I am missing something so I added how I build the NAT itself. Thanks –  Harun Baris Bulut Jan 7 at 18:19
    
Hi again Bandrami, I am trying to analyze the situation by looking at "iptraf" and with the previous configuration I was able to see ip 213.128.88.2 but with your config I cannot see it either. –  Harun Baris Bulut Jan 7 at 18:29
    
Thanks Bandrami, what you did was correct, however we applied it wrong :) –  Harun Baris Bulut Jan 18 at 8:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.