need assistence for PREROUTING

need assistence for PREROUTING

[Jochen Kaechelin]

I have a webserver/firewall behind a dsl-router.
The router opens port 80,...,...,4444.

machine 1:  192.168.178.112 + Firewall + Webserver Port 80, 1 Nic
machine 2:  192.168.178.32  + Webserver Port 80, 1 Nic

Now i want machine 1 to redirect all requests on Port 4444 to Port 
80 machine 2.


The following does not work:

$IPTABLES -t nat -A PREROUTING -i $ETH -p tcp --sport 
$UNPRIVPORTS --dport 4444 -d xxx.xxx.xxx.xxx -j DNAT --t
o-destination 192.168.178.32

$IPTABLES -A FORWARD -i $ETH -o $ETH --p tcp --sport $UNPRIVPORTS -d 
192.168.178.32 --dport 80 -m state --state NEW -j
 ACCEPT

$IPTABLES -A FORWARD -i $ETH -o $ETH -m state --state 
ETABLISHED,RELATED -j ACCEPT

Any hints?

Thanx.

-- 
Jochen Kaechelin, fvgi242ss, wlanhacking.de
http://mail.wlanhacking.de/cgi-bin/mailman/listinfo
http://www.gissmoh.de - Mein sonstiges Leben!!

RE: need assistence for PREROUTING

[Seferovic Edvin]

>$IPTABLES -t nat -A PREROUTING -i $ETH -p tcp --sport 
>$UNPRIVPORTS --dport 4444 -d xxx.xxx.xxx.xxx -j DNAT --t
>o-destination 192.168.178.32

You need port here !!! --to-destination 192.168.178.32:80

Regards,

Edvin Seferovic

Re: need assistence for PREROUTING

[Pascal Hambourg]

Hello,

Seferovic Edvin a écrit :
>>$IPTABLES -t nat -A PREROUTING -i $ETH -p tcp --sport 
>>$UNPRIVPORTS --dport 4444 -d xxx.xxx.xxx.xxx -j DNAT
>> --to-destination 192.168.178.32
> 
> You need port here !!! --to-destination 192.168.178.32:80

Also, 192.168.178.112 must be the gateway for the return packets so they 
are properly un-DNATed.