2

I have a Linux box with two interfaces:

~#ip -4 addr show scope global
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
inet 192.168.45.101/24 brd 192.168.45.255 scope global eth0
8: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
inet 172.17.1.230 peer 172.17.1.229/32 scope global tun0
10: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
inet 192.168.1.1/24 brd 192.168.1.255 scope global eth1
  • Eth0 is connected to our local network (other devices can be found on this network)
  • Eth1 is connected to one device (let name it BD) which has a static IP 192.168.1.5
  • Tun0 is our VPN network

I have two questions :)

  1. how can I reach the web server of the BD (192.168.1.5:80) from a machine that is on the local network (by taping on the browser 192.168.45.101:8080) or on the VPN network (by taping on the browser 172.17.1.230:8080)? I am really a big beginner on the network configuration :P so I understand from this that I should route the traffic from the port 8080 to the port 80
  2. the BD machine have one other TCP port 5017 that it uses to send an receive some data. How can I listen to this port from a machine that is connected on the local network or the VPN network?

here is what I did try for the first question (and of course didn't works):

~# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.5:80
~# iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.5:80
~#iptables -A FORWARD -i eth0 -p tcp --dport 80 -j ACCEPT
~#iptables -A FORWARD -i tun0 -p tcp --dport 80 -j ACCEPT

and Here is what I tried for the second question (the same thing .. didn't work):

~# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 5017-j DNAT --to-destination 192.168.1.5:5017
~# iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 5017-j DNAT --to-destination 192.168.1.5:5017
~#iptables -A FORWARD -i eth0 -p tcp --dport 5017 -j ACCEPT
~#iptables -A FORWARD -i tun0 -p tcp --dport 5017 -j ACCEPT

can someone help, please ... (I spend to 3 days on this problem and I have a deadline)

Thank you

4
  • 1
    For forwarding to work at all, make sure you have it enabled at all. Use sysctl -w net.ipv4.ip_forward=1 as root
    – Torin
    Oct 17 '18 at 17:22
  • I already enable it by having : net.ipv4.ip_forward=1 in /etc/sysctl.conf Oct 17 '18 at 17:24
  • Is your linux box the gateway of BD? If not you will have to add source NAT. Are you checking that the port forward is working from a computer other than the linux box?
    – Torin
    Oct 17 '18 at 17:44
  • the gateway of BD is 192.168.1.1 (my eth1) Oct 18 '18 at 8:28
1

There is the precudure to redirect traffic from one server to another :

#enable IP forwarding:
sudo sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/g' /etc/sysctl.conf

#then activate the changes
sudo sysctl -p

#Start iptables
sudo systemctl start iptables

#Check iptables rules:
(check that you don't have a deny policy )

#You can flush all rule to start in a clean env:
sudo iptables -F
#+For the nat 
sudo iptables -t nat -F

#Add rules
sudo iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.5:80

#To check :
sudo iptables -t nat -L -n

#Save the iptables rule :
sudo iptables-save | sudo tee /etc/iptables.up.rules

I hope it will work for you :)

1
  • That's works without MASQUERADE Thank you sir :) Oct 18 '18 at 11:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.