I have a setup where I have a CentOS server that is acting as an internet gateway. This machine performs the NAT between our main switch and our internet connection. I'm also hosting a virtual machine on this server which can be accessed using remote desktop on port 3389.
What I want to do is set up iptables so that port 10101 is forwarded from the wan side to 3389 on the lan side. I want people on the outside to ONLY be able to see port 10101 and have that redirected to port 3389 on the pc's local IP address.
In my setup I have a local adapter called lan0 (192.168.1.15) and another adapter called wan0 which gets our public IP address assigned to it. So I want it to look like this:
wan0 xxx.xxx.xxx.xxx:10101 -> lan0 192.168.1.15:3389
I've tried several things and I just can't seem to get it right. It seems like the difference between what I'm doing and most of the examples online is that most of the examples involve a gateway which forwards the traffic to a different pc whereas mine is still on the same system.
To make things clearer, here is my entire iptables config file including cjc's suggestion. I have included comments about the lines according to my understanding. I understand VERY little about iptables so please correct me if I'm wrong about ANYTHING.
# Generated by iptables-save v1.3.5 on Fri Jul 8 12:41:58 2011 *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [5:316] # route all requests for web traffic through squid on port 3128 -A PREROUTING -i lan0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.15:3128 # forward outside requests from 10101 to 3389 per cjc -A PREROUTING -i wan0 -p tcp --dport 10101 -j DNAT --to 192.168.1.15:3389 # needed for transparent squid proxy -A POSTROUTING -j MASQUERADE COMMIT # Completed on Fri Jul 8 12:41:58 2011 # Generated by iptables-save v1.3.5 on Fri Jul 8 12:41:58 2011 *filter :INPUT ACCEPT [89:5788] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1046:126223] :RH-Firewall-1-INPUT - [0:0] # accept all traffic from loopback -A INPUT -i lo -j ACCEPT # accept traffic destined to this machine regarding as part of existing connections -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # accept traffic destined to this machine from our local network -A INPUT -s 192.168.1.0/24 -j ACCEPT # accept traffic destined to this machine from the wan on port 10101 per cjc -A INPUT -i wan0 -p tcp --dport 10101 -j ACCEPT # reject all other wan traffic -A INPUT -i wan0 -j REJECT --reject-with icmp-port-unreachable # drop ping requests from the outside (is this needed and in the right order?) -A INPUT -i wan0 -p icmp -m icmp --icmp-type 8 -j DROP # allow forwarding of packets from the lan to the wan for squid proxying -A FORWARD -s 192.168.1.0/24 -i lan0 -o wan0 -m state --state NEW -j ACCEPT # allow forwarding of any packets pertaining to an existing connection -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT COMMIT # Completed on Fri Jul 8 12:41:58 2011