0

I have a problem with iptables. I would like to route https Traffic to a other Server. I created some iptables rules so that it should work from my point of view, but it does not. So There must be a misstake anywhere.

I have 3 Systems, 1. my Windows PC from which I try to connect over a Linux Server to a appliance Server.

Linux Server is the 10.10.11.5 The Appliance Server is on 10.10.11.17

I have created some rules:

iptables -t nat -A PREROUTING -i ens192 -p tcp --dport 443 -j DNAT --to 10.10.11.17:443
iptables -A FORWARD -i ens192 -p tcp --dport 443 -d 10.10.11.5 -j ACCEPT
iptables -t nat -A POSTROUTING -o ens192 -p tcp -d 10.10.11.17 -j SNAT --to-source 10.10.11.5

And tryed to open the site https://10.10.11.5 But nothing came up. The 10.10.11.17 is running and is responding on https.

To test further I created this rule:

iptables -t nat -A OUTPUT -p tcp  --dport 443  -j DNAT --to-destination 10.10.11.17:443

As I used telnet I got the connection to the other system. With out that rule there was no connection, which is correct, cause on the local system there is nothing listening on port 443.

To See if the Prerouting rule was used I reseted the counters on iptables and tryed to connect via the Browser. Die Counters at the rule counted some packages.

I do not have a clou why the rule is not doing the correct thing.

On the Appliance I could not use tcpdump to see if any package is coming in. I tried to caputre the packages going out on the Linux Server and every time I refreshed the Browser I got some packages at the Linux Server.

tcpdump -i ens192 -n port 443 -vvv
tcpdump: listening on ens192, link-type EN10MB (Ethernet), capture size 262144 bytes
08:17:18.381377 IP (tos 0x0, ttl 128, id 17760, offset 0, flags [DF], proto TCP (6), length 52)
    10.10.10.212.50261 > 10.10.11.5.https: Flags [S], cksum 0x3d12 (correct), seq 1461645297, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
08:17:18.381464 IP (tos 0x0, ttl 128, id 17761, offset 0, flags [DF], proto TCP (6), length 52)
    10.10.10.212.50262 > 10.10.11.5.https: Flags [S], cksum 0xe2cf (correct), seq 3258310427, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0

So I think my Prerouting rule does not set the correct IP into the Package.

Thank You all in advance.

Hope I did not forget anything.

Sascha

Here are MY IPTables NAT Table:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
PREROUTING_direct  all  --  anywhere             anywhere
PREROUTING_ZONES_SOURCE  all  --  anywhere             anywhere
PREROUTING_ZONES  all  --  anywhere             anywhere
DNAT       tcp  --  anywhere             anywhere             tcp dpt:https to:10.10.11.17:443

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
OUTPUT_direct  all  --  anywhere             anywhere
DNAT       tcp  --  anywhere             anywhere             tcp dpt:https to:10.10.11.17:443

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
POSTROUTING_direct  all  --  anywhere             anywhere
POSTROUTING_ZONES_SOURCE  all  --  anywhere             anywhere
POSTROUTING_ZONES  all  --  anywhere             anywhere
SNAT       tcp  --  anywhere             10.10.11.17          to:10.10.11.5

Chain OUTPUT_direct (1 references)
target     prot opt source               destination

Chain POSTROUTING_ZONES (1 references)
target     prot opt source               destination
POST_public  all  --  anywhere             anywhere            [goto]
POST_public  all  --  anywhere             anywhere            [goto]

Chain POSTROUTING_ZONES_SOURCE (1 references)
target     prot opt source               destination

Chain POSTROUTING_direct (1 references)
target     prot opt source               destination

Chain POST_public (2 references)
target     prot opt source               destination
POST_public_log  all  --  anywhere             anywhere
POST_public_deny  all  --  anywhere             anywhere
POST_public_allow  all  --  anywhere             anywhere

Chain POST_public_allow (1 references)
target     prot opt source               destination

Chain POST_public_deny (1 references)
target     prot opt source               destination

Chain POST_public_log (1 references)
target     prot opt source               destination

Chain PREROUTING_ZONES (1 references)
target     prot opt source               destination
PRE_public  all  --  anywhere             anywhere            [goto]
PRE_public  all  --  anywhere             anywhere            [goto]

Chain PREROUTING_ZONES_SOURCE (1 references)
target     prot opt source               destination

Chain PREROUTING_direct (1 references)
target     prot opt source               destination

Chain PRE_public (2 references)
target     prot opt source               destination
PRE_public_log  all  --  anywhere             anywhere
PRE_public_deny  all  --  anywhere             anywhere
PRE_public_allow  all  --  anywhere             anywhere

Chain PRE_public_allow (1 references)
target     prot opt source               destination

Chain PRE_public_deny (1 references)
target     prot opt source               destination

Chain PRE_public_log (1 references)
target     prot opt source               destination
0

This rule:

iptables -A FORWARD -i ens192 -p tcp --dport 443 -d 10.10.11.5 -j ACCEPT

is incorrect as it is processed AFTER PREROUTING table and FORWARD table will see CHANGED destination address. Change this rule to:

iptables -A FORWARD -i ens192 -p tcp --dport 443 -d 10.10.11.17 -j ACCEPT

The above rule WILL NOT cover returning packets, you need another rule for this:

iptables -A FORWARD -i ens192 -p tcp --sport 443 -s 10.10.11.17 -j ACCEPT

You can also simplify these two rules to:

iptables -A FORWARD -i ens192 -p tcp -m conntrack --ctstate ESTABLISHED,DNAT -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.