Solved

DNAT port forwards won't work from inside.

Posted on 2004-08-04
5
281 Views
Last Modified: 2010-05-18
Hi,
I have setup DNAT port forwards on my Linux box with IPtables to forward incoming web traffic (or whatever port) to an internal windows box.

It works fine from external machines (ie. other machines on the internet), but it won't work from machines on the Internal network (192.168.0.0/24) which use the linux box as a default gateway to nat out.

I have a friend who says that port forwards on his netgear router work from both internal and external.

How do I configure IPtables so that port forwards will work from inside?

Thanks,
Andrew
0
Comment
Question by:jonesy2k
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
5 Comments
 
LVL 14

Expert Comment

by:pablouruguay
ID: 11722866
example of nat to go outside

iptables -t nat -A POSTROUTING -s 192.168.1.65 -d 0.0.0.0/0 -j SNAT --to-source publicipaddress

but please poste your rules in here. to clarify the situation
0
 
LVL 4

Author Comment

by:jonesy2k
ID: 11722950
Here are my iptables rules. As you can see, I'm using MASQUERADE rather that SNAT
*nat
:PREROUTING ACCEPT [41:1889]
:POSTROUTING ACCEPT [2:152]
:OUTPUT ACCEPT [2:152]
-A PREROUTING -i eth1 -p 47 -j DNAT --to-destination 192.168.0.113
-A PREROUTING -i eth1 -p tcp --dport 1723 -j DNAT --to-destination 192.168.0.113:1723
-A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 192.168.0.121:80
-A POSTROUTING -s 192.168.0.0/255.255.255.0 -o eth1 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [50951:65998115]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [25947:1529635]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/255.0.0.0 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -s 192.168.0.0/255.255.255.0 -i eth0 -j ACCEPT
-A INPUT -s 192.168.0.0/255.255.255.0 -i eth1 -j REJECT --reject-with icmp-port-unreachable

-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 113 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -m unclean -j DROP
-A FORWARD -d 192.168.0.113 -j ACCEPT
-A FORWARD -d 192.168.0.121 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -j ACCEPT
-A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p tcp -m tcp -j REJECT --reject-with tcp-reset
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT
COMMIT
0
 
LVL 4

Author Comment

by:jonesy2k
ID: 11723245
I've actually answered my own question, but thanks for your willingness to help.
I needed to loosen the iptables prerouting so that it could come in any any interface.
I also had to allow forwarding to internal hosts.
0
 
LVL 5

Accepted Solution

by:
Netminder earned 0 total points
ID: 11723699
User resolved; closed, 125 points refunded.

Netminder
Site Admin
0

Featured Post

Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question