Re: Port Forwarding with iptables

[Wilson Mak <wilson.mak@digitalview.com>]

Nick Drage wrote:

>On Thu, Aug 19, 2004 at 06:57:59PM +0800, Wilson Mak wrote:
>  
>
>>Hi all,
>>
>>I like to do the portforwarding with iptables(forward web traffic of an 
>>alias IP - <ext ip> to internal web server).  Here is what I have:
>>
>>iptables -t nat -A PREROUTING -i eth0 -d <ext ip> -p tcp --dport 80 -j
>>DNAT --to 10.1.0.12:80
>>iptables -A INPUT -p tcp -i eth0 -d <ext ip> --dport 80 -m state
>>--state NEW -j ACCEPT
>>iptables -A FORWARD -p tcp -i eth0 -o eth1 -d <ext ip> --dport 80 -m
>>state --state NEW -j ACCEPT
>>
>>However, it keep droping the packets when getting to the NAT box.
>>
>>Logs
>>====
>>(With iptables -A FORWARD -d 10.1.0.12 -j LOG; iptable -A FORWARD -j DROP)
>>
>>kernel: IN=eth0 OUT=eth1 SRC=202.xxx.122.xxx DST=10.1.0.12 LEN=48
>>TOS=0x00 PREC=0x00 TTL=120 ID=6491 DF PROTO=TCP SPT=4023 DPT=80
>>WINDOW=64240 RES=0x00 SYN URGP=0
>>
>>Any clues?  Did I miss something here?
>>    
>>
>
>( caveat, this is a quick email during a lunch break at work, so it's
>all "best guess" )
>
>The rules in the PREROUTING table are executed before those in the
>FORWARD table, so the packet has a destination of 10.1.0.12 when it hits
>the FORWARD table.  So your third line should be
>
>iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 10.1.0.12 --dport 80 -m
>state --state NEW -j ACCEPT
>
>Let me know how you get on :)
>
>
>  
>
Thanks for all who help on this issue.  I mis-type the rule here.  Yes 
you guys are right, the rule should be: -d 10.1.0.12.  But still it 
doesn't work.  Do I need to enable something in the kernel when using 
Port-Forwarding?

Here are what I have now
===================
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

iptables -t nat -A PREROUTING -i eth0 -d <ext ip - an alias ip>  -p tcp 
--dport 80 -j DNAT --to 10.1.0.12:80
iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 10.1.0.12 --dport 80 -m 
state --state NEW -j ACCEPT
iptables -A FORWARD -t filter -i eth1 -m state --state 
NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -t filter -i eth0 -m state --state 
ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Many thanks,
Wilson