I have following problem.

 ----            ----            ----            ----
|    |          |3.1 |          |1.1 |          |    |
|3.20|----------|    |----------|    |----------|11.3|
|    |          |1.20|          |11.1|          |    |
 ----            ----            ----            ----
client          openwrt         cisco           proxy

I want that clients from network 3.0 can access 3.1:8888 which will be redirected to 11.3:8888

With this rules on openwrt-router it works:

  • iptables -t nat -A PREROUTING -i lan -p tcp --dport 8888 -j DNAT --to-destination
  • iptables -t nat -A POSTROUTING -o wan -p tcp --dport 8888 -j MASQUERADE
  • iptables -A FORWARD -p tcp -i lan -s -o wan -d -j ACCEPT
  • iptables -A FORWARD -p tcp -i wan -s -o lan -d -j ACCEPT

Is there any other solution for this issue which opens a listening port for the clients in the subnet 3.0 without the dst-nat rule?

Has anyone an explaination why this solution with the src-nat and dst-nat rule works?

  • The postrouting rule also can be realized with SNAT rule: iptables -t nat -A POSTROUTING -o wan -p tcp --dport 8888 -j SNAT --to-source – Franz Jan 6 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.