Re: Suse 9.1 port forwarding woes

[Jason Opperisano <opie@817west.com>]

On Mon, Jan 10, 2005 at 12:28:53PM -0800, Nathan March wrote:
> Despite my best attempts, I cannot seem to get port forwarding working 
> on a suse 9.1 machine using iptables.
> 
> My firewall.sh:
> 
> #!/bin/bash
> 
> IPTABLES='/usr/sbin/iptables'
> 
> EXTIF='eth0'
> INTIF1='eth1'
> INTIF2='eth2'
> 
> /bin/echo 1 > /proc/sys/net/ipv4/ip_forward
> 
> $IPTABLES -F
> $IPTABLES -t nat -F
> $IPTABLES -X
> 
> $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
> 
> $IPTABLES -A FORWARD -m state --state ESTABLISHED -j ACCEPT
> $IPTABLES -A FORWARD -p icmp -m state --state RELATED -j ACCEPT
> 
> 
> $IPTABLES -A FORWARD -i $INTIF1 -o $EXTIF -m state --state 
> NEW,ESTABLISHED -j ACCEPT
> $IPTABLES -A FORWARD -i $INTIF2 -o $EXTIF -m state --state 
> NEW,ESTABLISHED -j ACCEPT
> 
> $IPTABLES -A INPUT --protocol tcp --dport 22 -j ACCEPT
> $IPTABLES -A INPUT --protocol tcp --dport 25 -j ACCEPT
> $IPTABLES -A INPUT --protocol tcp --dport 143 -j ACCEPT
> 
> $IPTABLES -A FORWARD -i eth0 -d 192.168.0.3 --protocol tcp --dport 80 -j 
> ACCEPT
> $IPTABLES -A PREROUTING -i eth0 -t nat -p tcp --dport 80 -j DNAT --to 
> 192.168.0.3:80
> 
> 
> After the script runs:
> linux:~ # iptables --list
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination        
> ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
> ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp
> ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap
> 
> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination        
> ACCEPT     all  --  anywhere             anywhere            state 
> ESTABLISHED
> ACCEPT     icmp --  anywhere             anywhere            state RELATED
> ACCEPT     all  --  anywhere             anywhere            state 
> NEW,ESTABLISHED
> ACCEPT     all  --  anywhere             anywhere            state 
> NEW,ESTABLISHED
> ACCEPT     tcp  --  anywhere             192.168.0.3         tcp 
> dpt:http flags:FIN,SYN,RST,ACK/SYN state NEW
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination        
> linux:~ # iptables -t nat --list
> Chain PREROUTING (policy ACCEPT)
> target     prot opt source               destination        
> DNAT       tcp  --  anywhere             anywhere            tcp 
> dpt:http to:192.168.0.3
> 
> Chain POSTROUTING (policy ACCEPT)
> target     prot opt source               destination        
> MASQUERADE  all  --  anywhere             anywhere           
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> 
> Anyone have any ideas what I'm doing wrong?

i can tell you that the output of "iptables --list" you provide here does
not reflect the script above.  which might be the root of your problem.

-j

--
"The lesson is: Our God is vengeful! O spiteful one, show me who to
 smite and they shall be smoten!!!"
        --The Simpsons