0

I have two Linux servers. I need to forward the incoming connection from server A (1.1.1.1:25565) to server B (2.2.2.2:25598) (as an example). I've tried multiple iptables rules, with partial success. The problem is the fact that the IP is not forwarded.

As an example, I have a Minecraft server. When there is a connection, it forwards me from 1.1.1.1 to 2.2.2.2, however, the IP that players have is not their network IP, but server A IP (1.1.1.1 in the current example). Would it be possible to somehow forward the connected IP as well?

If that is not possible, is there a possibility that I send a packet with the connection so I can inform the game-server of what IP player is using and make the server change it from Server A IP to real Connection IP (like this plugin does)? From what I saw using it, it just splits the incoming connection packet and gets the connection IP, port and timestamp. Does anyone know how?

Rules that I tried:

# Rule 1
iptables -t nat -A PREROUTING -p tcp --dport 25568 -j DNAT --to-destination 2.2.2.2:30026
iptables -t nat -A POSTROUTING -j MASQUERADE
# Rule 2
iptables -t nat -A PREROUTING -p tcp --dport 25599 -j DNAT --to-destination 2.2.2.2:30026
iptables -t nat -A POSTROUTING -p tcp -d 2.2.2.2 --dport 30026 -j SNAT --to-source 1.1.1.1
# Rule 3
iptables -t nat -A PREROUTING -p tcp -d 1.1.1.1 --dport 12222 -j DNAT --to 2.2.2.2:30026
iptables -A FORWARD -p tcp -d 2.2.2.2 --dport 30026 -j ACCEPT
iptables -t nat -A POSTROUTING -j MASQUERADE

Don't look too much at ports, I know those are not the same at every command but those do not really matter.

1

You can reach your objective by setting default route on 2.2.2.2 to 1.1.1.1 and then removing the POSTROUTING MASQUERADE/SNAT rules from your IPTables rules.

However, this means that all access to 2.2.2.2 must happen via 1.1.1.1.

The reason you see modified IP addresses is the SNAT / MASQUERADE rule. This replaces IP packet source address with 1.1.1.1, and is required when 2.2.2.2 has other default route than 1.1.1.1.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.