RE: Failing to get forwarding to work fully.

["Rob Sterenborg" <rob@sterenborg.info>]

> I have tried to get this iptables script on my Centos 4.4 machine
> working, with some help, but still have not succeeded in forwarding
> port 722 to a machine on the LAN attached to the machine running
> iptables attached to the internet. The logging of the FORWARD
> packets just before drop tells me they are being forwarded. I also
> made sure the the LAN attached machine on eth0 does accept ssh -D
> 722 once I logged into the public facing machine via ssh. So I kinda
> assume it is the return packet that is the problem, but cannot see
> why. Ideas? 333.333.333.333 is substituted for the public IP addr,
> 111.111.111.111 222.222.222.222 are machines I want to be the only
> ones that can access. eth0 is the LAN NIC and eth1 is the public
> facing NIC.
> 
> # Generated by iptables-save v1.2.11 on Thu Dec 15 17:00:25 2005
> *filter

[...]

> -A FORWARD -j LOG --log-level debug
> -A FORWARD -d 192.168.0.0/255.255.255.0 -i eth1 -o eth0 \
>     -p tcp -m multiport --dports 22,3306 -m state --state NEW \
>     -j ACCEPT

So NEW packets forwarded to port 22 will be allowed.

> -A FORWARD -i eth1 -o eth0 -m state \
>     --state RELATED,ESTABLISHED -j ACCEPT

Here you are only accepting packets from eth1 -> eth0 in a RELATED or
ESTABLISHED connection. What about the return packets that will go from
eth0 -> eth1? I really don't think you can setup a connection this way.
Try:

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT


Grts,
Rob