0

Problem

I cannot get requests to my server on port 80 to redirect to my client on port 8080

Server

I am using a CentOS 6.3 VM as the server, the client is an Arduino

Server eth0 - 172.16.145.139 eth1 - 10.14.4.1

Client eth0 - 10.14.45

End Goal

Any sort of fix that will allow me to get the webpage from my internal client

What I have Tried

I have tried to modify my iptables in various ways to allow me access. Closest I got was my client registered that a connection was made but the webpage would not load. This also occurred when I used an SSH tunnel. So I think there is some setting that I am over looking that is not allowing it to forward correctly

# cat /proc/sys/net/ipv4/ip_forward
1

IPTABLES

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 10.14.4.5:8080
-A POSTROUTING -s 10.14.4.0/25 -o eth0 -j SNAT --to-source 172.16.145.139
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -s 10.14.4.0/25 -o eth0 ! -d 10.14.4.0/25 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

Thanks in advance for any and all help!

Improve this question

1 Answer 1

Reset to default
0

Here's what works for me on my VM server (adapted to your IPs):

## Allow through firewll
iptables -I FORWARD -d 10.14.4.5/32 -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
## Set up NAT forwarding rule
iptables -t nat -I PREROUTING -p tcp -i eth0 --destination-port 8080 -j DNAT --to-destination 10.14.4.5:80

It looks like you are missing the first rule, which allows the packets to come through the firewall. The nat rule on yours looks ok though.

Note, that "-I" inserts at the top of the rule chain, "-A" appends to the bottom. In the case of the first rule, we want it to come before the "reject" rule in your filter table -- the easiest way is to go ahead and insert it at the top (if you are modifying an existing table -- otherwise, go ahead and convert it to "-A" and put it before the "reject" rule if modifying an existing config file).

Improve this answer
3
  • Makes sense, just wondering about this 10.14.4.5/32. This rule is to allow my clients packets through on port 80? Then I would want it to be for my network 10.14.4.0/25? Thanks for your help, I really appreciate it!
    – arduinosystem
    Apr 30, 2013 at 2:24
  • I'm assuming your internal host is 10.14.4.5 (the messages has "10.4.45"). So yes, this is in the Filter table (the default table if no "-t ..." flag is specified), and specifically in the FORWARD chain (section) of the filter table. The FORWARD chain examines any inbound packet that is getting forwarded to somewhere else. So the 10.14.4.5/32 says to look at only packets bound for ip address 10.14.4.5, and where the destination port is 80, and allow them through. So as long as this appears before the final "FORWARD...REJECT" line they will go through.
    – Derek Pressnall
    Apr 30, 2013 at 2:41
  • Ran out of room in the previous comment -- but to answer your question, yes you can also specify "10.14.4.0/24" and leave off the --dport (or specify a range), and what would allow packets in to any host you set up a forward rule to. I normally don't do that, so I don't have any verified examples handy and wanted to make sure I posted a working example. But if you still have trouble I'll work out an example in my lab tomorrow and update the post.
    – Derek Pressnall
    Apr 30, 2013 at 2:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .