0

I use several PREROUTING rules in Jessie Debian to do port forward from WAN to LAN ip with following rule

iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 8088 -j DNAT --to-destination 192.168.1.6:8088

ETH0 is public static IP
ETH0:0 is Local lan ip 192.168.1.2

These are NAT related IPTABLES

iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       tcp  -- !192.168.0.0/24       0.0.0.0/0            tcp dpt:8088 to:192.168.1.6:8088
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8091 to:192.168.1.7:80
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8092 to:192.168.1.1:80
DNAT       tcp  -- !192.168.0.0/24       0.0.0.0/0            tcp dpt:10554 to:192.168.2.10:554
DNAT       udp  -- !192.168.0.0/24       0.0.0.0/0            udp dpt:10554 to:192.168.2.10:554
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:10080 to:192.168.2.1:8081
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:10443 to:192.168.2.4:10443
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:10052 to:192.168.2.1:8080
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:34567 to:192.168.2.10:34567
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:10050 to:192.168.2.1:10050

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0           
SNAT       tcp  --  0.0.0.0/0            192.168.2.10         tcp dpt:554 to:192.168.1.2
SNAT       udp  --  0.0.0.0/0            192.168.2.10         udp dpt:554 to:192.168.1.2
SNAT       tcp  --  0.0.0.0/0            192.168.2.1          tcp dpt:8081 to:192.168.1.2
SNAT       tcp  --  0.0.0.0/0            192.168.2.4          tcp dpt:10443 to:192.168.1.2
SNAT       tcp  --  0.0.0.0/0            192.168.2.1          tcp dpt:8080 to:192.168.1.2
SNAT       tcp  --  0.0.0.0/0            192.168.2.10         tcp dpt:34567 to:192.168.1.2
SNAT       tcp  --  0.0.0.0/0            192.168.2.1          tcp dpt:10050 to:192.168.1.2

However this rule is applied also when accessing that port from LAN. As result I can enter any IP and port 8088 to browser URL and it will always reach destination. for example I can enter http://1.1.1.1:8088 and it will work. this is not desired behaviour.

I'd like to exclude LAN from PREROUTING.

I tried ! -s 192.168.0.0/24 but in prerouting "!" for source parameter does not work

I tried also another approach to use destination parameter "-d mydoman.com" in the rule, but this only works if I remove mydoman.com line from /etc/hosts because mydoman.com links to server local network IP. I'd like to keep that record too.

is there better way to avoid prerouting rule for local network?

  • What do you mean by 'for source parameter does not work'? You can use ! for source address in the PREROUTING chain without any problem. – ALex_hha Feb 23 '16 at 10:02
  • I mean that agent with LAN ip 192.168.1.8 still can access service by entering any.ip.addres:8088 on port 8088 even if this rule is applied iptables -t nat -I PREROUTING ! -s 192.168.0.0/24 -i eth0 -p tcp -m tcp --dport 8088 -j DNAT --to-destination 192.168.1.6:8088 – B.Ondrej Feb 23 '16 at 10:19
  • Shouldn't work. Could you add list of rules from nat table to the question – ALex_hha Feb 23 '16 at 10:23
  • yes, I also think it Shouldn't work. added iptables list NAT relevant portion – B.Ondrej Feb 23 '16 at 10:34
  • Is 192.168.1.2 default gateway for 192.168.0.0/24 subnet? Have you checked counter for the rule when clients get access to the 192.168.1.6:8088. Does the counter growing? – ALex_hha Feb 23 '16 at 10:46
1

If you intend to exclude 192.168.1.8 from the DNAT rule, you shall use 192.168.0.0/23 or 192.168.1.0/24 as the ! -s parameter. The network range 192.168.0.0/24 finishes at 192.168.0.255.

$ ipcalc 192.168.0.0/24
Address:   192.168.0.0          11000000.10101000.00000000. 00000000
Netmask:   255.255.255.0 = 24   11111111.11111111.11111111. 00000000
Wildcard:  0.0.0.255            00000000.00000000.00000000. 11111111
=>
Network:   192.168.0.0/24       11000000.10101000.00000000. 00000000
HostMin:   192.168.0.1          11000000.10101000.00000000. 00000001
HostMax:   192.168.0.254        11000000.10101000.00000000. 11111110
Broadcast: 192.168.0.255        11000000.10101000.00000000. 11111111
Hosts/Net: 254 

You may restrict the DNAT rule by interfaces instead of using addresses. For example:

iptables -t nat -A PREROUTING '!' -i eth0 -p tcp --dport 8088 \
    -j DNAT --to-destination 192.168.1.6:8088

Or:

iptables -t nat -A PREROUTING -i ${your_wan_interface} -p tcp --dport 8088 \
    -j DNAT --to-destination 192.168.1.6:8088

Using the RETURN target is also a possible choice:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8088 -j RETURN
| improve this answer | |
  • Many thanks Anderson, how I could completely forget count proper mask... in fact I need to exclude 192.168.1-3.x - and indeed using mask /22 will fit and work also for PREROUTING. What confused me was that some people in forums says that "! -s" is not supported. indeed wrong information. I will be probably using mask approach however will also review "restrict the DNAT rule by interfaces" and RETURN options later – B.Ondrej Feb 23 '16 at 14:46
  • The IPTABLES manpage doesn't mention any restriction on using the exclamation mark in source specification nor in PREROUTING chain, so it's supposed to work. – Anderson Medeiros Gomes Feb 24 '16 at 1:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.