0

I have a NAT server setup with 4 servers behind it. I have a PREROUTING entry to allow https/443 INTO my environment, specifically to to a web server running IIS on port 443. This works fine. However, whenever any of the 4 servers attempt OUTBOUND access on 443 (i.e., https://www.google.com), their traffic is rerouted to the IIS web server running on 443. In other words, when I access https:// from any machine behind the nat server, it redirects my traffic to my internal server hosting IIS. Removing the prerouting entry obviously resolves the issue, but I need to allow 443 in. Any idea how to resolve this?

Current IP Table:

Chain PREROUTING (policy ACCEPT 12621 packets, 1054K bytes) pkts bytes target prot opt in out source destination 7384 383K DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:10.10.11.17:443

Chain INPUT (policy ACCEPT 1 packets, 52 bytes) pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 11483 packets, 1155K bytes) pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 99260 packets, 5162K bytes) pkts bytes target prot opt in out source destination 93469 7682K MASQUERADE all -- * eth0 10.10.10.0/23 0.0.0.0/0

  • How many eth-interfaces are you using on your NAT-box? Two? One toward "external/Internet" side and one towards your "internal" backends? If not, please exand your question. If yes, than what you're experiencing is "normal", as PRE-ROUTING acts the same way (by-design), regardless of the incoming physical interface. So in such a case, you've to "limit" the PREROUTING behaviour by filtering --for example-- on "sender" (-s !your_internal_NET or similar) or with some other approach. If you provide further details, than we could be more helpful. – Damiano Verzulli May 31 '16 at 18:19
  • using 1 interface--eth0 – LWood May 31 '16 at 19:29
  • You should expand.... slightly more! How are, your mentioned 4 servers, the NAT-box and respective gateway, connected? What IP/subnet? Are there additional FW/hosts/boxes? (BTW: I'm asking 'cause.... I'm currently missing my "magic-crystal-ball"!) – Damiano Verzulli May 31 '16 at 19:48
  • It's a simple, flat network. All 4 servers access the same gateway. Firewall rules are such that anything can come in and anything can go out for testing purposes. There is a public ip address associated with the NAT Server. The IIS web server is ip 10.10.11.17. Because of the PREROUTING entry, any machine that attempts to access an https:// site ends up being routed to 10.10.11.17. I need to make sure that does not happen. – LWood Jun 1 '16 at 0:57
  • "All 4 servers access the same gateway": is such gateway your NAT box? – Damiano Verzulli Jun 1 '16 at 5:05

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.