0

In our setup we have a linux server with 2 NICs, one connecting to our LAN/internet and one connecting to a windows machine that is also serving RDP. We want to connect to via RDP and land on the win machine of course.

I set up fixed IPs between the 2 -> ping works. Additionally I have the following iptables settings:

iptables -t nat -A PREROUTING -p tcp -d <external IP of linux machine> --dport 3389 -j DNAT --to-destination <IP of win machine>
iptables -t nat -A POSTROUTING -p tcp -s <IP of win machine> --dport 3389 -j SNAT --to-source <external IP of linux machine>

I also tried with

iptables -t nat -A POSTROUTING -p tcp -s <IP of win machine> --sport 3389 -j SNAT --to-source <external IP of linux machine>

No RDP connection possible. Am I even doing the right thing? Should I try not specifying any port on the SNAT rules?

/edit: tried SNAT without specifying a port and also couldn't connect.

/edit: tried MASQUERADE instead of SNAT and still no success.

sudo iptables -t nat -A POSTROUTING -o <outgoing interface on linux machine> -j MASQUERADE

/edit: tried deliberately forwarding via

sudo iptables -A FORWARD -p tcp --dport 3389 -j ACCEPT

But still no connection.

/edit: Suspecting network manager be the source of the problem. I manually defined the internal interface of the linux machine. It still shows up in network manager and the problem is still not solved.

5
  • You need to allow in FORWARD input on outgoing linux interface on linux machine (your rule will do this) and also allow in FORWARD packets from windows machine to outside. And forwarding (echo 1 > /proc/sys/net/ipv4/ip_forward) should be enabled on linux, of course. – Laurentiu Roescu Nov 8 '16 at 13:02
  • "also allow in FORWARD packets from windows machine to outside" How do I do this? I thought the POSTROUTING nat rule does this? – steW Nov 8 '16 at 13:27
  • sudo iptables -A FORWARD -s <IP of win machine> -j ACCEPT – Laurentiu Roescu Nov 8 '16 at 13:53
  • Just tried that and did not solve it. :( – steW Nov 8 '16 at 14:01
  • Maybe you have some other rules which deny connection. I added rules you need as an answer. – Laurentiu Roescu Nov 8 '16 at 14:21
0
sudo iptables -t nat -A PREROUTING -i <outgoing interface on linux machine> -p tcp --dport 3389 -j DNAT --to-destination <IP of win machine>
sudo iptables -t nat -A POSTROUTING -o <outgoing interface on linux machine> -j SNAT --to-source <external IP of linux machine>
sudo iptables -A FORWARD -i <outgoing interface on linux machine> -p tcp --dport 3389 -j ACCEPT
sudo iptables -A FORWARD -s <IP of win machine> -j ACCEPT

cat /proc/sys/net/ipv4/ip_forward should return 1

Be careful that iptables -A add just append the rule to the chain. This means that if there is already a rule which deny your packets, it will be executed first and your new rule will never match. If you are unsure, you can test above rules using iptables -I instead of iptables -A. Your rule will be inserted in chain, becoming the first rule to be executed.

8
  • "outgoing interface on linux machine" I assume this is the interface not connected to the win-machine, right? Othwerwise, thank you! ip_forward does not return 1 so there is something wrong. I'll write in a bit with findings! – steW Nov 8 '16 at 14:23
  • Okay, sadly it didn't help. cat /proc/sys/net/ipv4/ip_forward now returns 1 (was 0) and I double checked the iptables. The only rules in there are ones on port 3389, telnet (also by me) and 48898 (also be me), all identically set up to accept packages, forward them to the win machine and changing dnat/snat respectively. Any more ideas? – steW Nov 8 '16 at 14:46
  • see pastebin.com/G2W0X3vR for the full iptables config right now. 10.0.0.211 is the external IP of the linux machine. 10.49.0.2 the internal IP of the linux machine. 10.49.0.3 the win IP. Pinging from the linux machine to the win machine works. – steW Nov 8 '16 at 14:50
  • /edit: the postrouting SNAT and DNAT for 3389 rule was missing, added it -> still no connection – steW Nov 8 '16 at 14:56
  • @steW Please use iptables -L -v -n and iptables -L -v -n -t nat, using -v adds more info to output. – Laurentiu Roescu Nov 8 '16 at 15:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.