1

I have the following infrastructure in place:

 internet   [outside 81.x.x.x] router [inside 192.168.1.1] 
                                    |    [network 192.168.1.0/24] 
                                    | 
                                   mail server [192.168.1.2]

On the router (DD-WRT) with iptables. I have NAT enabled since I want my mailserver to respond for the outside IP. I have the following setup:

iptables -t nat -I PREROUTING -d 81.x.x.x -j DNAT --to 192.168.1.2 
iptables -t nat -I POSTROUTING -s 192.168.1.2 -j SNAT --to 81.x.x.x 
iptables -I FORWARD -d 192.168.1.2 -p tcp --dport 25 -j ACCEPT

with some other open ports as well.

However, when mail arrives to the mailserver postfix show the following message:

postfix/smtpd[6964]: connect from unknown[192.168.1.1]

All mails coming from outside seems that is comming with the routers inside IP address. What am I missing, so that the original IP address is shown, instead of the routers inside IP?

5
  • 1
    Your first iptables rule (DNAT) is missing protocol & dest. port selection, is that intentional? – sam_pan_mariusz Feb 22 '15 at 7:10
  • @sam_pan_mariusz It's called 1-to-1 NAT. – Michael Hampton Feb 22 '15 at 14:28
  • @Michael Hampton - It's not clear in the question, but looks like Zoli has 1-to-1 NAT on the same public IP address as he uses for SNAT. I never met anything like that, wonder how it works. 1-to-1 often makes sense with mail servers, but only when there's more than one public IP. – sam_pan_mariusz Feb 22 '15 at 17:40
  • @sam_pan_mariusz Yes, it's 1-to-1 NAT, I have more than one public IP and more servers for what I'm doing NAT. – Zoli Feb 22 '15 at 18:48
  • Are you sure these are the only SNAT rules in your firewall? I suspect some other rule is not shown above applying the undesired effect. – Zoredache Feb 22 '15 at 20:08
0

You appear to have set up a 1-to-1 NAT with the first two iptables rules, but then you've added a third, rather curious rule:

iptables -I FORWARD -d 192.168.1.2 -p tcp --dport 25 -j ACCEPT

Such rules aren't necessary when doing 1-to-1 NAT, and don't actually do anything useful. Of the information you've given, this appears to be the most likely cause of the problem. Simply remove it.

iptables -D FORWARD -d 192.168.1.2 -p tcp --dport 25 -j ACCEPT
2
  • 1
    Even if the default policy for the FORWARD chain is DROP or REJECT? I was going to suggest deleting the second rule, since the SNAT should only be necessary for outgoing connections. A complete list of iptables -t nat -L -n might help. – Cedric Knight Feb 22 '15 at 16:30
  • Hm, if the forward policy is DROP then you might need something like that after all. I stopped using DD-WRT some time ago since it's basically unmaintained anymore. – Michael Hampton Feb 22 '15 at 16:32
0

ISTR oddities like this before, but there's something missing as you say. The following information might be useful from the router:

iptables -t nat -L -n
iptables -L -n
ip route

And this from the mail server:

iptables -t nat -L -n
ip route
grep . /proc/sys/net/ipv4/conf/*/rp_filter

Without that info, I think I'd just wipe out your existing firewall and do something more specific:

iptables -t nat -F  # also on server
iptables -t nat -I PREROUTING -p tcp -d 81.x.x.x --dport 25 \
    -j DNAT --to 192.168.1.2:25

And see what is happening in the mail logs. If you need the SNAT for outgoing SMTP, something like:

iptables -t nat -I POSTROUTING -p tcp -s 192.168.1.2 --dport 25 \
    -m multiport --sports 1024:65535 -j SNAT --to 81.x.x.x:25

And if a local DNS resolver is insufficient:

iptables -t nat -I POSTROUTING -p udp -s 192.168.1.2 --dport 53 \
    -j SNAT --to 81.x.x.x
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.