iptables localport forwarding is posible?

Question

In my network i want to forward port from Proxy to the Server,

so firewall will can reach its HTTP port, as in Firewall the forward is disabled.

It look like it Internet Router > Firewall > Proxy > Server

-> Router   10.0.1.1 <-> 10.0.1.2  Firewall ->
-> Firewall 10.0.2.1 <-> 10.0.2.2  Proxy    ->
-> Proxy    10.0.3.1 <-> 10.0.3.2  Server

Firewall can connect to Proxy, but not to the Server as routing and forwarding are disabled.

I want router to connect to Proxy:80 and it to be forwarded to Server:80

i've tried this rules in "Proxy" but doesn't work

#!/bin/sh

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -F
iptables -t nat -F
iptables -X

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.3.2:80
iptables -t nat -A POSTROUTING -p tcp -d 10.0.3.2 --dport 80 -j SNAT --to-source 10.0.2.1

any suggestions?

Answer 1

I don't see any information about the routes being present on the devices. If Server has no route to reach Firewall, or has a route pointing to anything else than 10.0.3.1, the replies will fail to get back to the Firewall.

Also, assuming that Firewall originates the connection to Proxy, the source IP address will be 10.0.2.1 and the second iptables rule will not change anything.

If you want to make this work only from iptables on the Proxy, you should use the following rules:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.3.2:80
iptables -t nat -A POSTROUTING -p tcp -d 10.0.3.2 --dport 80 -j SNAT --to-source 10.0.3.1

Or even better, let the system choose the SNAT address:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.3.2:80
iptables -t nat -A POSTROUTING -p tcp -d 10.0.3.2 --dport 80 -j MASQUERADE

Generally is good to specify exactly what traffic should be matched, so you could add source/destination address in the first rule unless you really mean 'send all http traffic to 10.0.3.2'.