Tag Info

Hot answers tagged

2

Connection tracking. If the device connects from inside the NAT to outside, then related packets from the outside system are permitted in. This can be done with both TCP and UDP in some cases.


1

Although traffic can flow in both directions when NAT is in place, the important distinction is that without port forwarding, a server cannot "listen" for new connections on a specific port from hosts outside that network. Take the example of when one browses a web page. The important point here is that your browser is the client; it's reaching out to ...


1

5) Will our LAN be limited to 65536 (or some other theoretical limit) concurrent connections to the outside world through a single public IP address? No, because one port NAT IP can be used for multiple connections: cat /proc/net/ip_conntrack | grep 51380 tcp 6 191 ESTABLISHED src=10.1.8.5 dst=17.133.254.23 sport=51380 dport=5223 src=17.133.254.23 ...


1

The issue is that your NAT rule in the PREROUTING chain of the nat table translates host's port 3306 to 172.17.0.2:33066 and not to 172.17.0.2:3306 thus the rule in the FORWARD chain of the filter table doesn't match anything since it tries to drop traffic forwarded to destination port 3306.


1

You need nat traversal (nat-t) or nat hole punching. This is a partial solution, as many nat gateways will not allow that. This means you'll need servers with public IPs to pass the traffic between restricted nat clients as part of your solution.


1

Tero Kilkanen pointed me in the right direction on this, although it took a while for me to work out the syntax. It looks like iptables was confused regarding which IP the newly redirected data should go to. DNAT specifies the target port AND the target IP, so it works correctly now. The final commands I used were as follows: su root -c "/sbin/iptables -t ...


1

I think the security-level should be considered. You can ping from Inside to Outside, but the echo traffic must be allowed to go back to Inside.


1

Assuming you've checked the basics like ensuring that the access list is actually bound to the interface with the access-group command, if the logs are showing that the traffic is being denied, you can find out more information by simulating a packet with the packet-tracer command. That should tell you exactly why the packet is being rejected. Assuming your ...



Only top voted, non community-wiki answers of a minimum length are eligible