9

I do not have the router so I made my CentOS 6.4 Linux system into a router, forwarding the public network traffic to my local LAN. It has two NIC cards, one for the public IP address (eth1) and another for the private IP address (eth2).

I have a server connected to my local LAN, let's say at 192.168.1.2.

Router

  • eth1: x.x.x.x, the public IP address
  • eth2: 192.168.1.1, the internal router address

When someone from an outside network runs ssh on the public IP, it should be redirected to the server:

ssh x.x.x.x or using PuTTY

I disabled the SELinux and iptables firewall on the server. I tried some iptables modifications on the Linux system router, but the SSH request is still not redirected:

iptables -t nat -A PREROUTING -p tcp -d 192.168.1.1 --dport 22 -j DNAT --to-destination 192.168.1.2:22

I also want to forward all HTTP (80) traffic to my internal server using iptables from the same Linux system router.

1
  • Can you provide your iptables -L output? Jan 1, 2014 at 13:12

4 Answers 4

8

First of all make sure the packet forwarding is enabled in the kernel

# echo 1 > /proc/sys/net/ipv4/ip_forward

You can also make it permanent by adding below line to /etc/sysctl.conf

net.ipv4.ip_forward = 1

You have to do this on Linux Machine acting as a router. You can try the following rule on router machine.

iptables -t nat -A PREROUTING -i eth1 -d x.x.x.x -p tcp --dport 22 -j  DNAT --to-destination 192.168.1.2:22

Also let us know the output of your NAT Rules from the router box.

iptables -t nat -L -n -v
4
  • Yes, just replace the port number. Use 80 for HTTP Jan 1, 2014 at 13:41
  • Hi, sandeep i want one thing that in my server i made a apache webserver. i want to access the particular site which is hosted on server. how i can do this. on browser publicip:80/path to directory but not accessible.help me.
    – Rahul
    Jan 1, 2014 at 14:17
  • Try to first open the site from your LAN 192.168.1.2/path then see what happens. If you are still facing issues, I suggest opening a new thread with detailed problem description explaining what have you configured with Apache. Jan 1, 2014 at 14:29
  • pkts bytes target prot opt in out source destination ` 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2222 to:192.168.88.2:2222 ` but can not port forwarding?
    – CS QGB
    Dec 20, 2022 at 12:46
3

Based on this amazing DigitalOcean's tutorial about how to forward ports, I decided to re-write it here.

I spent many hours of research about how this works.. I'm new to linux and beginnings aren't always easy.. Here is example of my servers and it's port forwarding:

Firewall server (2 NIC cards) - network details:

  • Public IP address: xx.xx.xx.xx
  • Private IP address: yy.yy.yy.yy
  • Public interface: eth0
  • Private interface: eth1

Internal (e.g. ssh, web) server (1 NIC card) - network details:

  • Private IP address: zz.zz.zz.zz
  • Private interface: eth0

Solution:

Enable packet forwarding in kernel:

echo 1 > /proc/sys/net/ipv4/ip_forward

Define variables:

# Admin IP address (e.g. public home ip)
ADMIN="aa.aa.aa.aa"

# IP addresses of servers (e.g. in cloud):
FW_eth0_ip="xx.xx.xx.xx"
FW_eth1_ip="yy.yy.yy.yy"
WEB_eth0_ip="zz.zz.zz.zz"

# Services:
SSH="22"
HTTP="80"

Iptables port forwarding (with -m conntrack):

iptables -t nat -A PREROUTING -i eth0 -s $ADMIN -d $FW_eth0_ip -p tcp --dport $SSH -j DNAT --to-destination $WEB_eth0_ip
iptables -A FORWARD -i eth0 -o eth1 -p tcp --syn --dport $SSH -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport $SSH -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp --sport $SSH -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -p tcp --dport $SSH -d $WEB_eth0_ip -j SNAT --to-source $FW_eth1_ip

Few notes:

  • "..-s $ADMIN -d $FW_eth0_ip.." (1st row) - added only for security reasons - it means that only ADMIN IP can access SSH (if not needed you can delete it)
  • -m conntrack is the same as -m state
  • I recommend to change default port of SSH to another port, like 1xxxx (in /etc/ssh/sshd_config)
  • check List of TCP and UDP port numbers
  • I use port 15xx1 to access SSH on Firewall server, and 15xxx2 the Internal

Terminal:

# access firewall server
$ ssh [email protected] -p 15xx1

# access internal server
$ ssh [email protected] -p 15xx2

More details about used rules are perfectly described in mentioned tutorial.

That's all from me, hope it will help you.

1
  • # telnet 192.168.88.254 2222 telnet: cannot connect to remote host (192.168.88.254): Connection refused # telnet 192.168.1.4 2222 telnet: cannot connect to remote host (192.168.1.4): Connection refused
    – CS QGB
    Dec 20, 2022 at 12:50
1

Although this question is about iptables, in case you also have FirewallD running, here's how to access HTTP of the internal network.

First allow http traffic in your internal server FirewallD:

# firewall-cmd --permanent --add-service=http

Then forward the http traffic from the external ip, to port 80 of the internal ip:

# firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toaddr=10.0.0.11

Same thing can be done for SSH service.

1

First of all, enable routing in the Linux gateway:

echo 1 > /proc/sys/net/ipv4/ip_forward

Then add the following rules with your network interface (i.e., eth1) and desired ports:

iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.2
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 22 -j DNAT --to 192.168.1.2
iptables -A FORWARD -p tcp -d 192.168.1.2 --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.2 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Check your rules with iptables -L -v, the pkts and bytes columns will show you which rules are being matched.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .