Portforwarding with IPTABLES and Remote IP detection

Question

I was able to forward 80 port from my primary server 192.168.90.1 to the second one 192.168.90.2 with IPTABLES

The primary server has a public address X.X.X.X

so I forwarded X.X.X.X:80 -> 192.168.90.2:80

My problem is that the second server consider that all traffic coming from Internet is from 192.168.90.1 (all remote addresses are 192.168.90.1 and not the real address of clients exp: will show 192.168.90.1 instead of the client IP )

Is there somebody who faced this problem? I need to fix it without using a reverse proxy solution

This is how I forward my packets:

iptables -A PREROUTING -t nat -d X.X.X.X -p tcp --dport 80 -j DNAT --to-destination 192.168.90.2:80

iptables -t nat -A POSTROUTING -d 192.168.90.2 -p tcp --dport 80 -j SNAT --to X.X.X.X

Answer 1

1. It looks like it is coming from the first router as it SNAT-ted. So remove the SNAT rule to keep the original source IP address of incoming traffic.
2. Then, tell the second server that its default router should be the first server which knows how to route it back to the source.

I assume that all the other things are configured properly:

• IP forwarding enabled
• no other blocking iptables rules

Answer 2

From my understanding, your primary server has two fixed ip addresses :

• the private one : 192.168.90.1 (let's say eth0)
• the public one : X.X.X.X (let's say wan0)

Assuming i am right :

Actually, your SNAT rule is doing NAT for all TCP traffic, when destination is 192.168.90.2:80

I am not sure that this rule is relevant because you have already forwarded port 80 in your DNAT rule, and primary and secondary servers are on the same subnet (private IPs) so you don't need specific routing to make them talk together...

I think you should remove your SNAT rule.

---

In my opinion, your SNAT rule would make more sense to NAT all outgoing traffic to the Internet with your public IP.

Maybe you should change it by adding a filter on outgoing interface, to SNAT only traffic going to your WAN interface :

iptables -t nat -A POSTROUTING -o wan0 -p tcp --dport 80 -j SNAT --to X.X.X.X

But, if your secondary server can already access the Internet, that means your routing and rules are already correct. So you don't need this SNAT rule.