-1

I have been learning to use iptables recently and i made a small nat network in virtualbox. I have a Debian server Natting for the internal clients. One of the internal clients is hosting a minecraft server for testing.

What im wanting to do is have any incoming connections using port 25565 going in eth0 from the debian server, to forward them specifically to the internal minecraft server (192.168.200.4) out eth1. Just like you would in a regular Linksys router.

What i had come up with, but doesnt actually work was:

iptables -A FORWARD -i eth0 --dport 25565 -o eth1 -d 192.168.200.4 -j ACCEPT

Then i read in the errors and other tuts out there, that its actually POSTROUTING/PREROUTING that i need to use. so then i tried:

iptables -t nat -A POSTROUTING -i eth0 -p tcp --dport 25565 -o eth1 -d 192.168.200.4 -j ACCEPT

Now obviously none of these work, but i want to know if i am in the right track?

Here is a diagram of the virtual network so yall can see it visually:

https://i.stack.imgur.com/P9rZS.jpg

Currently, the iptables config looks like this:

Chain INPUT (policy ACCEPT)
target      prot  opt  source                    destination
ACCEPT      all   --   anywhere                  anywhere                 
ACCEPT      all   --   anywhere                  anywhere                 state RELATED,ESTABLISHED
ACCEPT      all   --   anywhere                  anywhere                 tcp dpt:telnet

Chain FORWARD (policy ACCEPT)
target      prot  opt  source                    destination
ACCEPT      all   --   anywhere                  anywhere                 state RELATED,ESTABLISHED
ACCEPT      all   --   anywhere                  anywhere

Chain OUTPUT (policy ACCEPT)
target      prot  opt  source                    destination

Any additional details will be gladly added :)

(Anything in the INPUT chain is just other rules i was messing with earlier, originally, the only rules it had were the ones under the FORWARD chain)

This is the tutorial that i had followed for NAT: http://www.revsys.com/writings/quicktips/nat.html

1 Answer 1

1

In your scheme, your External IP is incorrect : 192.168.1.161 is an internal IP.

You have a real External (public) IP : check it with e.g http://www.whatismyip.com (hope it is a fixed one).

First, you need to use the PREROUTING chain to DNAT your External IP to your Internal IP :

iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_IP --destination-port 25565 -j DNAT --to 192.168.200.4:25565

Then, you need to allow packet forwarding between interfaces from source to target :

iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 192.168.200.4 --destination-port 25565 -m state --state NEW -j ACCEPT

However, surch Google about how to do this for a Web Server and you will find a lot of ressources (on this site also). The logic remains the same.

2
  • oh no, i know 192.168.1.xx is a class c private IP, in the schema im just using it as an external. but what just hit me is that, it might not work becuase private ip's arent routable. i would have to either use a nat network from virtual box and add one more external host as the minecraft client and try it that way. but ill try what you posted. thanks!
    – xR34P3Rx
    Nov 4, 2014 at 0:56
  • oh, what... the nat in vbox is a 10 network, also private. nvm. ill just try this then
    – xR34P3Rx
    Nov 4, 2014 at 0:58

Not the answer you're looking for? Browse other questions tagged .