0

this is my scenario:

Netbook (192.168.1.2) ===> (192.168.1.1) Linux Server (192.168.0.4) ===> NAS (192.168.0.2)
Netbook (192.168.1.2) ===> (192.168.1.1) Linux Server (192.168.0.4) ===> Router (192.168.0.1)

I would like to do port forwarding with iptables in order to reach the NAS and Router on port 80 with my Netbook. Both servers have a service on port 80, so depending on what I decide to do sometimes I open port 80 on the NAS, sometimes on the Router.

IP forwarding is enabled, masquerading as well.

This is my /etc/iptables.ipv4.nat file:

 Generated by iptables-save v1.4.14 on Wed Apr 30 23:02:30 2014  
*nat :PREROUTING ACCEPT [42:14791] :INPUT ACCEPT [31:2623] :OUTPUT ACCEPT [1:48]
:POSTROUTING ACCEPT [1:48]  
-A PREROUTING -i wlan1 -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 22  
-A PREROUTING -i wlan1 -p udp -m udp --dport 53 -j REDIRECT --to-ports 53  
-A PREROUTING -i wlan1 -p tcp -m tcp --dport 5901 -j DNAT --to-destination 192.168.0.2:5901  
-A PREROUTING -i wlan1 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040  
-A POSTROUTING -o wlan1 -j MASQUERADE COMMIT  
 Completed on Wed Apr 30 23:02:30 2014  
 Generated by iptables-save v1.4.14 on Wed Apr 30 23:02:30 2014  
*filter :INPUT ACCEPT [904:141326] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [946:157235]  
-A FORWARD -d 192.168.0.0/24 -i wlan1 -o wlan0 -p tcp -m tcp --dport 5901 -j ACCEPT  
-A FORWARD -d 192.168.0.0/24 -i wlan1 -o wlan0 -p tcp -m tcp --dport 80 -j ACCEPT COMMIT  
 Completed on Wed Apr 30 23:02:30 2014  

Furthermore on my router (192.168.0.1) I have a static route: Network 192.168.1.0, Subnet 255.255.255.0, Gateway 192.168.0.4

The reason for the multiple /24 nets is that on the 192.168.1.0 net a DHCP server is running for all the connected devices to the Linux Server which is acting as an access point and TOR router (port 9040). At the same time a DHCP server is running on the router 192.168.0.1 for the devices connecting to the router.

The port forwarding for port 5901 works like a charm by the way.

  • Sounds like you're having a routing issue, and not an actual firewall issue. It would make more sense for you to build a 2nd subnet on your router or use your Linux server as a default gateway between the two different subnets. – CIA May 6 '14 at 19:19
  • On my router there is a static route which enables my devices to ping each other. As soon as i try to address a specific port related service (80, 5901, etc) without any port-forwarding, I won't have any access. The traffic is blocked. So far the only solution that somehow works is port-forwarding in combination with the static route. – Daniel May 6 '14 at 19:22
  • Can you provide the static route(s) in your question? – CIA May 6 '14 at 19:24
  • sure, sorry for that, question is updated – Daniel May 6 '14 at 19:30
  • Is there a reason you have multiple /24 subnets? – CIA May 6 '14 at 19:35
0

Unless I am misunderstanding, why not simply map different target ports on the Linux Server to port 80 on the backend devices. For example:

Netbook --> 192.168.1.1:8080 (Linux Server) --> 192.168.0.2:80 (NAS)
Netbook --> 192.168.1.1:8081 (Linux Server) --> 192.168.0.1:80 (Router)

You already have the commands you need, you just need to set --dport to a different target port on the Linux Server, while specifying port 80 in --to-destination.

  • Good idea but unpractical. I would need to always specify the port 8080 or 8081 requesting the NAS or Router. I dont wanna do that. I just want to open the IP address in the netbooks browser (192.168.0.2 or 192.168.0.1) and open the appropriate web service on their port 80. best solution would be to route the traffic on port 80 1:1 to the other subnet without a different handling of the ports. Firewalls usually have this option. I tried to set the --to-destination to 192.168.0.0:80 (in order to address the whole subnet) but that didn't work out. – Daniel May 6 '14 at 18:20
  • So you just want to route the traffic, not using any port NAT? – Kyle Smith May 6 '14 at 18:30
  • If possible, yes. I've tried uncountable suggestions without NAT but using the NAT rules above is so far the only thing that worked at all. – Daniel May 6 '14 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.