0

I'm facing an issue about port forwarding. My case is extremely simple. I want to connect to a remote server but there is an IP restriction. Only my main server is allowed to connect. I would like to be able to connect to remote server with a third computer:

Third computer(10.10.0.2) ==== > main server(172.16.15.3) ====> remote server(192.168.10.5:80)

Actually I use SSH port forward:

ssh -L 12345:192.168.10.5:80 user@172.16.15.3
wget 127.0.0.1:12345

But I have to manage SSH connection and always check if the tunnel is up. That's why I want to use NAT but it's not working at all ! The main server is on Fedora.

sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

I tried to do this:

iptables -A PREROUTING -t nat -i enp3s0 -p tcp --dport 81 -j DNAT --to-destination 192.168.10.5:80
iptables -A FORWARD -p tcp -d 192.168.10.5 --dport 80 -j ACCEPT
iptables -A POSTROUTING -t nat -s 192.168.10.5 -o enp3s0 -j MASQUERADE

But when i try to connect I see my incoming packet with tcpdump but there is none outgoing packet

telnet 172.16.15.3 81

Do you any idea how to fix it?

Best regards

  • 2
    The most common mistake for novice firewall administrators is that they add a new rule and then discover that it won't take effect. The reason for that is that the -A option appends that new rule, after all existing rules . Please remember that firewall rules are checked in the order they are listed. The kernel will stop processing the chain when the first rule is triggered that will either allow or dis-allow a packet or connection and the new rule may never be reached. So please consider (posting) your complete firewall (with [sudo] iptables -L -v -n ) rather than only new rules – HBruijn Jan 9 '18 at 11:29
  • Also: AFAIK --to-destination takes an IP-address as the argument, not ip:port as what you're doing with 192.168.10.5:80 – HBruijn Jan 9 '18 at 11:29
  • @HBruijn --to-destination 192.168.10.5:80 is perfectly fine. @OP try flushing the chains like HBruijn said, because your rules look fine to me. You are sure the packets arrive at the target service on port 80? – Lenniey Jan 9 '18 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.