0

I have a router with public IP address ADDR and private IP address 192.168.1.1.
I also have a public domain DOMAIN with an A record pointing to ADDR.

The router has a built-in SMB server.
I can access the SMB shares internally by typing \\ADDR\ShareName into Windows Explorer.
However, I want to be able to also access them via \\DOMAIN\ShareName internally.

Currently this doesn't work because Samba is not listening on the public interface. It only listens on the private interface, and I obviously don't want to change this and introduce a security hole.

So I redirect port 445 of ADDR to 192.168.1.1 when the source is in the local subnet:

iptables -t nat -I PREROUTING 1 -s 192.168.0.0/16 -p tcp --dport 445 -j DNAT --to-destination 192.168.1.1:445

but this doesn't work for some reason, and I don't understand why. (I don't know iptables well.)
Why doesn't this work? And how can I make it work?

(And yes, cat /proc/sys/net/ipv4/ip_forward gives 1.)

0

This isn't something you should try to solve using iptables. Simply have separate internal zone for your domain and make the hostname resolve to the local IP of your service.

BTW, even if iptables was the solution, your 192.168.1.1 is probably part of 192.168.1.0/24 instead of 192.168.0.0/16.

5
  • No, I can't make the hostname resolve to the local IP. The router's internal web interface (and really, anything else that is local-only) is served on its local IP and that would clash with services that I want to make public. I really do think I need to use iptables here.
    – user541686
    Oct 16 '17 at 22:26
  • Then, make it \\smb.domain or something. Subdomains exists for that purpose. Oct 16 '17 at 22:29
  • No, I don't want to make users deal with multiple domains just for the sake of file sharing. I'd appreciate it if you could just answer the question I've asked. If you think iptables cannot or should not be used then I would appreciate being a clear explanation of why, rather than merely being told to do it a different way. Otherwise this doesn't answer my question at all.
    – user541686
    Oct 16 '17 at 22:32
  • Hint to the right direction on the second paragraph. Oct 16 '17 at 22:36
  • I can make that change but that wouldn't fix any problem though, would it? I'm confused why you're emphasizing that.
    – user541686
    Oct 16 '17 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.