From: "Stanislav Puffler DiS." <stanislav.puffler@seznam.cz>
To: Netfilter Mailing List <netfilter@lists.netfilter.org>
Subject: still can´t FORWARD tcp on 25 port to another destination...
Date: Fri, 12 Mar 2004 15:56:24 +0100 [thread overview]
Message-ID: <4051CF98.1020008@seznam.cz> (raw)
Hallo,
I can´t still FORWARD any incoming tcp packets (port 25) from Internet
coming to my external interface eth0 (82.142.67.253) to destination in
my network (192.168.200.2). Here is my complete ruleset from
iptables-save. I am 2 days without any idea or success :( Could anyone
help please ?
# Generated by iptables-save v1.2.6a on Fri Mar 12 14:53:44 2004
*nat
:PREROUTING ACCEPT [342:36496]
:POSTROUTING ACCEPT [42:3408]
:OUTPUT ACCEPT [66:5557]
-A PREROUTING -i eth2 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
-A PREROUTING -s 192.168.0.0/255.255.0.0 -i eth0 -j DROP
-A PREROUTING -s 172.16.0.0/255.240.0.0 -i eth0 -j DROP
-A PREROUTING -s 10.0.0.0/255.0.0.0 -i eth0 -j DROP
-A PREROUTING -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination
192.168.200.2:25
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Fri Mar 12 14:53:44 2004
# Generated by iptables-save v1.2.6a on Fri Mar 12 14:53:44 2004
*filter
:INPUT DROP [83:8337]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:spoofing - [0:0]
:syn_flood - [0:0]
:tcp_segmenty - [0:0]
:udp_pakety - [0:0]
-A INPUT -i eth0 -p tcp -j tcp_segmenty
-A INPUT -i eth0 -p udp -j udp_pakety
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -i eth2 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 113 -j REJECT --reject-with
icmp-port-unreachable
-A INPUT -i eth0 -j spoofing
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j syn_flood
-A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT
-A INPUT -s 80.95.96.7 -i eth0 -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -i eth2 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A FORWARD -i eth1 -j ACCEPT
-A FORWARD -i eth2 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o eth1 -j ACCEPT
-A FORWARD -i eth0 -j spoofing
-A FORWARD -d 192.168.200.2 -i eth0 -p tcp -m tcp --dport 25 -m state
--state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -s 127.0.0.1 -j ACCEPT
-A OUTPUT -s 192.168.0.1 -j ACCEPT
-A OUTPUT -s 192.168.200.1 -j ACCEPT
-A OUTPUT -s 82.142.67.253 -j ACCEPT
-A spoofing -s 192.168.0.0/255.255.0.0 -j DROP
-A spoofing -s 172.16.0.0/255.240.0.0 -j DROP
-A spoofing -s 10.0.0.0/255.0.0.0 -j DROP
-A syn_flood -m limit --limit 1/sec -j RETURN
-A syn_flood -j DROP
-A tcp_segmenty -p tcp -m tcp --dport 25 -j ACCEPT
-A tcp_segmenty -p tcp -m tcp --dport 80 -j ACCEPT
-A udp_pakety -p udp -m udp --dport 53 -j ACCEPT
COMMIT
# Completed on Fri Mar 12 14:53:44 2004
Thanks in advance,
Stanislav Puffler.
next reply other threads:[~2004-03-12 14:56 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-03-12 14:56 Stanislav Puffler DiS. [this message]
2004-03-12 16:54 ` still can´t FORWARD tcp on 25 port to another destination Stanislav Puffler DiS.
2004-03-12 17:13 ` Antony Stone
2004-03-12 17:34 ` Stanislav Puffler DiS.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4051CF98.1020008@seznam.cz \
--to=stanislav.puffler@seznam.cz \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.