DNAT port forwards won't work from inside.

Hi,
I have setup DNAT port forwards on my Linux box with IPtables to forward incoming web traffic (or whatever port) to an internal windows box.

It works fine from external machines (ie. other machines on the internet), but it won't work from machines on the Internal network (192.168.0.0/24) which use the linux box as a default gateway to nat out.

I have a friend who says that port forwards on his netgear router work from both internal and external.

How do I configure IPtables so that port forwards will work from inside?

Thanks,
Andrew
LVL 4
jonesy2kAsked:
Who is Participating?
 
NetminderConnect With a Mentor Commented:
User resolved; closed, 125 points refunded.

Netminder
Site Admin
0
 
pablouruguayCommented:
example of nat to go outside

iptables -t nat -A POSTROUTING -s 192.168.1.65 -d 0.0.0.0/0 -j SNAT --to-source publicipaddress

but please poste your rules in here. to clarify the situation
0
 
jonesy2kAuthor Commented:
Here are my iptables rules. As you can see, I'm using MASQUERADE rather that SNAT
*nat
:PREROUTING ACCEPT [41:1889]
:POSTROUTING ACCEPT [2:152]
:OUTPUT ACCEPT [2:152]
-A PREROUTING -i eth1 -p 47 -j DNAT --to-destination 192.168.0.113
-A PREROUTING -i eth1 -p tcp --dport 1723 -j DNAT --to-destination 192.168.0.113:1723
-A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 192.168.0.121:80
-A POSTROUTING -s 192.168.0.0/255.255.255.0 -o eth1 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [50951:65998115]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [25947:1529635]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/255.0.0.0 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -s 192.168.0.0/255.255.255.0 -i eth0 -j ACCEPT
-A INPUT -s 192.168.0.0/255.255.255.0 -i eth1 -j REJECT --reject-with icmp-port-unreachable

-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 113 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -m unclean -j DROP
-A FORWARD -d 192.168.0.113 -j ACCEPT
-A FORWARD -d 192.168.0.121 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -j ACCEPT
-A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p tcp -m tcp -j REJECT --reject-with tcp-reset
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT
COMMIT
0
 
jonesy2kAuthor Commented:
I've actually answered my own question, but thanks for your willingness to help.
I needed to loosen the iptables prerouting so that it could come in any any interface.
I also had to allow forwarding to internal hosts.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.