port forwarding in a web server

port forwarding in a web server

[Juan Hernandez]

Hi there...

   This may have been answered many times in this mailing list but I
haven't found anything on the web about something that would make my
server forward the way I want to, and what's ironic is that it seems
simple. Here's my scenario: I have a static IP address routed (1.1.1.1)
to one server using a 192.168.0.* address. Is a cisco router and
everything works fine. This server has 192.168.0.1 as it's address and
functions as a web server, everything works fine but, I have another
server that works as our mail server that is using 192.168.0.2. I've
been trying to redirect everything coming from port 25 to my mail server
but it doesn't get any answer. These are the rules I've been using: 

echo 1 > /proc/sys/net/ipv4/ip_forward

modprobe iptable_nat

#allow all outgoing traffic from the mail server 

iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 192.168.0.1

#dnat
iptables -t nat -A PREROUTING -p tcp --dport 25 -i eth0 -j DNAT --to
192.168.0.1:25

The gateway on the mailserver is 192.168.0.1 which is the webserver that
it's forwarding everything... and I have tried so many things that
sometimes the webserver stops working...

Using that configuration, if I nmap the webserver it shows that tport 25
is filtered but, if i telnet to taht port I wont get any response... and
the mailserver is running perfectly, it's just not forwarding anything

Any suggestions would be appreciated...

Thanks a lot for your time

Juan

RE: port forwarding in a web server

[Rob Sterenborg]

> simple. Here's my scenario: I have a static IP address routed 
> (1.1.1.1)
> to one server using a 192.168.0.* address. Is a cisco router and
> everything works fine. This server has 192.168.0.1 as it's address and

So I can assume that *ALL* traffic is routed from 1.1.1.1 to 192.168.0.1,
which has Netfilter running ?

> functions as a web server, everything works fine but, I have another
> server that works as our mail server that is using 192.168.0.2. I've
> been trying to redirect everything coming from port 25 to my 
> mail server
> but it doesn't get any answer. These are the rules I've been using: 

echo 0 > /proc/sys/net/ipv4/ip_forward
iptables -P FORWARD DROP
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -d 192.168.0.2 -p tcp --dport 25 -j ACCEPT
iptables -t nat -A PREROUTING -d 192.168.0.1 -p tcp --dport 25 \
    -j DNAT --to-destination 192.168.0.2:25
echo 1 > /proc/sys/net/ipv4/ip_forward

If you're forwarding anything else than just smtp, you have to add rules to
allow it : these rules DROP all traffic to be forwarded except smtp which is
DNAT-ed to the MTA and RELATED/ESTABLISHED traffic.


Gr,
Rob

RE: port forwarding in a web server

[Juan Hernandez]

No, the webserver (the one that has the internet address 1.1.1.1 and the
internal in another NIC 192.168.0.1) is the one that is forwarding
everything that comes to port 25 to the mailserver 192.168.0.2 

Thanx

Juan

On Mon, 2003-11-24 at 13:11, Rob Sterenborg wrote:
> > simple. Here's my scenario: I have a static IP address routed 
> > (1.1.1.1)
> > to one server using a 192.168.0.* address. Is a cisco router and
> > everything works fine. This server has 192.168.0.1 as it's address and
> 
> So I can assume that *ALL* traffic is routed from 1.1.1.1 to 192.168.0.1,
> which has Netfilter running ?
> 
> > functions as a web server, everything works fine but, I have another
> > server that works as our mail server that is using 192.168.0.2. I've
> > been trying to redirect everything coming from port 25 to my 
> > mail server
> > but it doesn't get any answer. These are the rules I've been using: 
> 
> echo 0 > /proc/sys/net/ipv4/ip_forward
> iptables -P FORWARD DROP
> iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
> iptables -A FORWARD -d 192.168.0.2 -p tcp --dport 25 -j ACCEPT
> iptables -t nat -A PREROUTING -d 192.168.0.1 -p tcp --dport 25 \
>     -j DNAT --to-destination 192.168.0.2:25
> echo 1 > /proc/sys/net/ipv4/ip_forward
> 
> If you're forwarding anything else than just smtp, you have to add rules to
> allow it : these rules DROP all traffic to be forwarded except smtp which is
> DNAT-ed to the MTA and RELATED/ESTABLISHED traffic.
> 
> 
> Gr,
> Rob
> 
> 

RE: port forwarding in a web server

[Juan Hernandez]

Thank you so much pal... 

Now its working

Juan :D

On Mon, 2003-11-24 at 13:11, Rob Sterenborg wrote:
> > simple. Here's my scenario: I have a static IP address routed 
> > (1.1.1.1)
> > to one server using a 192.168.0.* address. Is a cisco router and
> > everything works fine. This server has 192.168.0.1 as it's address and
> 
> So I can assume that *ALL* traffic is routed from 1.1.1.1 to 192.168.0.1,
> which has Netfilter running ?
> 
> > functions as a web server, everything works fine but, I have another
> > server that works as our mail server that is using 192.168.0.2. I've
> > been trying to redirect everything coming from port 25 to my 
> > mail server
> > but it doesn't get any answer. These are the rules I've been using: 
> 
> echo 0 > /proc/sys/net/ipv4/ip_forward
> iptables -P FORWARD DROP
> iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
> iptables -A FORWARD -d 192.168.0.2 -p tcp --dport 25 -j ACCEPT
> iptables -t nat -A PREROUTING -d 192.168.0.1 -p tcp --dport 25 \
>     -j DNAT --to-destination 192.168.0.2:25
> echo 1 > /proc/sys/net/ipv4/ip_forward
> 
> If you're forwarding anything else than just smtp, you have to add rules to
> allow it : these rules DROP all traffic to be forwarded except smtp which is
> DNAT-ed to the MTA and RELATED/ESTABLISHED traffic.
> 
> 
> Gr,
> Rob
> 
> 

Re: port forwarding in a web server

[Jeffrey Laramie]

Juan Hernandez wrote:

>Hi there...
>
>   This may have been answered many times in this mailing list but I
>haven't found anything on the web about something that would make my
>server forward the way I want to, and what's ironic is that it seems
>simple. Here's my scenario: I have a static IP address routed (1.1.1.1)
>to one server using a 192.168.0.* address. Is a cisco router and
>everything works fine. This server has 192.168.0.1 as it's address and
>functions as a web server, everything works fine but, I have another
>server that works as our mail server that is using 192.168.0.2. I've
>been trying to redirect everything coming from port 25 to my mail server
>but it doesn't get any answer. These are the rules I've been using: 
>
>echo 1 > /proc/sys/net/ipv4/ip_forward
>
>modprobe iptable_nat
>
>#allow all outgoing traffic from the mail server 
>
>iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 192.168.0.1
>
>#dnat
>iptables -t nat -A PREROUTING -p tcp --dport 25 -i eth0 -j DNAT --to
>192.168.0.1:25
>
>The gateway on the mailserver is 192.168.0.1 which is the webserver that
>it's forwarding everything... and I have tried so many things that
>sometimes the webserver stops working...
>  
>

I'm having trouble understanding questions this morning (maybe I need 
more coffee!). Is this your configuration?

router   <->   [firewall box]   <->   [webserver]   <->   [mailserver]

This won't work since the webserver doesn't know what to do with the 
packets your sending it on port 25. You need to direct the packets to 
192.168.0.2 port 25. If the mailserver is on a different LAN then you 
should be using a different subnet for each LAN. You'll also have to 
configure the mailserver to forward packets.

Hope this helps

Jeff

port forwarding in a web server

[Juan Hernandez]

Hi there...

   This may have been answered many times in this mailing list but I
haven't found anything on the web about something that would make my
server forward the way I want to, and what's ironic is that it seems
simple. Here's my scenario: I have a static IP address routed (1.1.1.1)
to one server using a 192.168.0.* address. Is a cisco router and
everything works fine. This server has 192.168.0.1 as it's address and
functions as a web server, everything works fine but, I have another
server that works as our mail server that is using 192.168.0.2. I've
been trying to redirect everything coming from port 25 to my mail server
but it doesn't get any answer. These are the rules I've been using: 

echo 1 > /proc/sys/net/ipv4/ip_forward

modprobe iptable_nat

#allow all outgoing traffic from the mail server 

iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 192.168.0.1

#dnat
iptables -t nat -A PREROUTING -p tcp --dport 25 -i eth0 -j DNAT --to
192.168.0.1:25

The gateway on the mailserver is 192.168.0.1 which is the webserver that
it's forwarding everything... and I have tried so many things that
sometimes the webserver stops working...

Using that configuration, if I nmap the webserver it shows that tport 25
is filtered but, if i telnet to taht port I wont get any response... and
the mailserver is running perfectly, it's just not forwarding anything

Any suggestions would be appreciated...

Thanks a lot for your time

Juan

RE: port forwarding in a web server

[Aldo S. Lagana]

" it's just not forwarding anything"

Add FORWARD rules -d 192.168.0.1 -j ACCEPT

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Juan Hernandez
Sent: Monday, November 24, 2003 11:05 AM
To: Lista de netfilter

Hi there...

   This may have been answered many times in this mailing list but I
haven't found anything on the web about something that would make my
server forward the way I want to, and what's ironic is that it seems
simple. Here's my scenario: I have a static IP address routed (1.1.1.1)
to one server using a 192.168.0.* address. Is a cisco router and
everything works fine. This server has 192.168.0.1 as it's address and
functions as a web server, everything works fine but, I have another
server that works as our mail server that is using 192.168.0.2. I've
been trying to redirect everything coming from port 25 to my mail server
but it doesn't get any answer. These are the rules I've been using: 

echo 1 > /proc/sys/net/ipv4/ip_forward

modprobe iptable_nat

#allow all outgoing traffic from the mail server 

iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 192.168.0.1

#dnat
iptables -t nat -A PREROUTING -p tcp --dport 25 -i eth0 -j DNAT --to
192.168.0.1:25

The gateway on the mailserver is 192.168.0.1 which is the webserver that
it's forwarding everything... and I have tried so many things that
sometimes the webserver stops working...

Using that configuration, if I nmap the webserver it shows that tport 25
is filtered but, if i telnet to taht port I wont get any response... and
the mailserver is running perfectly, it's just not forwarding anything

Any suggestions would be appreciated...

Thanks a lot for your time

Juan

RE: port forwarding in a web server

[Juan Hernandez]

Thank you all for your help but this was answered yesterday... if you'd
like, ill forward the mail in which it ended

Juan

On Wed, 2003-11-26 at 11:24, Aldo S. Lagana wrote:
> " it's just not forwarding anything"
> 
> Add FORWARD rules -d 192.168.0.1 -j ACCEPT
> 
> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Juan Hernandez
> Sent: Monday, November 24, 2003 11:05 AM
> To: Lista de netfilter
> 
> Hi there...
> 
>    This may have been answered many times in this mailing list but I
> haven't found anything on the web about something that would make my
> server forward the way I want to, and what's ironic is that it seems
> simple. Here's my scenario: I have a static IP address routed (1.1.1.1)
> to one server using a 192.168.0.* address. Is a cisco router and
> everything works fine. This server has 192.168.0.1 as it's address and
> functions as a web server, everything works fine but, I have another
> server that works as our mail server that is using 192.168.0.2. I've
> been trying to redirect everything coming from port 25 to my mail server
> but it doesn't get any answer. These are the rules I've been using: 
> 
> echo 1 > /proc/sys/net/ipv4/ip_forward
> 
> modprobe iptable_nat
> 
> #allow all outgoing traffic from the mail server 
> 
> iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 192.168.0.1
> 
> #dnat
> iptables -t nat -A PREROUTING -p tcp --dport 25 -i eth0 -j DNAT --to
> 192.168.0.1:25
> 
> The gateway on the mailserver is 192.168.0.1 which is the webserver that
> it's forwarding everything... and I have tried so many things that
> sometimes the webserver stops working...
> 
> Using that configuration, if I nmap the webserver it shows that tport 25
> is filtered but, if i telnet to taht port I wont get any response... and
> the mailserver is running perfectly, it's just not forwarding anything
> 
> Any suggestions would be appreciated...
> 
> Thanks a lot for your time
> 
> Juan
> 
> 
> 
> 
> 
>