I would like to make CentOS a port forwarding NAT machine using iptables. This is the first time I've tried this and I think i might need a little help.

This is the configuration i'm trying to achieve. I'm trying to make a remote desktop connection through the CentOS machine on port 80 and have CentOS connect to the server on port 80. is the client that should connect to port 80 on by connecting to (CentOS) on port 80.

  • CentOS ens160 is
  • CentOS ens192 is
  • CentOS ens224 is

What I tried so far:

  1. Disabled SELINUX
  2. Enabled IPv4 forwarding in /etc/sysctl.conf

    net.ipv4.ip_forward = 1
  3. /etc/systemconfig/iptables is

    :INPUT ACCEPT [0:0]
    :OUTPUT ACCEPT [12:944]
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -i lo -j ACCEPT
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
    -A INPUT -j REJECT --reject-with icmp-host-prohibited
    -A FORWARD -i ens160 -o ens192 -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -i ens192 -o ens160 -j ACCEPT
    -A FORWARD -i ens160 -o ens224 -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -i ens224 -o ens160 -j ACCEPT
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited
    :INPUT ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    -A PREROUTING -i ens160 -p tcp -m tcp --dport 80 -j DNAT --to-destination

So is there anything wrong with my iptables rules? Or is there something I might be missing?

| improve this question | | | | |

Anyway, you are missing a FORWARD RULE

iptables -A FORWARD -i ens160 -o ens192 -p tcp -m tcp -d -m state --state NEW -j ACCEPT

You need to insert the above rules, before this:

-A FORWARD -j REJECT --reject-with icmp-host-prohibited
| improve this answer | | | | |
  • Thanks, It works. I have tried this before but I place it after the reject. – Yuan Chen Nov 19 '14 at 15:02

In RedHat Entrprise Linux 7.0 (the "upstream" of CentOS 7.0) the intended interaction with iptables is through firewalld. Manually modifying the iptables configuration, while possible, is not the intended method if interaction.

If you do want to modify the iptables configuration directly you might want to have a look at documentation about iptables. You're going down the right path but, for example, the -i and -o arguments are meant to denote ingress and egress interfaces (eth0, etc), not hostnames. It looks like you just need some background on how iptables works.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.