Re: Port forwarding with iptables

[Martijn Lievaart <m@rtij.nl>]

KUCKAERTZ Régis - NVISION wrote:

>Hello,
>
>Our ISP only allows connections coming from a well-defined list of IP
>addresses. Since we must be able to log on to our servers no matter where we
>are, I just thought using iptables on one host having one of the authorized
>IP addresses would be the solution.
>
>So I went on reading iptables docs and howtos, but as you might guess I
>couldn't stand how to do it exactly. Let's put it correctly stated: every
>incoming connection to, say, port 3999 of my host ($HOST_IP) should be
>forwarded to port 123 of the protected server ($SERVER_IP). I tried the
>following two rules:
>
>$IPTABLES -t nat -A PREROUTING -p tcp --dst $HOST_IP --dport 3999 -j DNAT
>--to-destination $SERVER_IP:123
>
>   This one should do the forwarding
>
>

This one looks fine.

>$IPTABLES -t nat -a POSTROUTING -p tcp --dst $SERVER_IP --dport 123 -j
>MASQUERADE
>
>   ... and this one should masquerade
>
>

That looks non sensical, what are you trying to accomplish? Drop this
line of thought. MASQUERADE is for when you connect through a
dynamically assigned IP address, e.g. dial-up.

What you need is a rule in FORWARD to allow the packets to pass.
Assuming you accept ESTABLISHED (and RELATED) packets somewhere, so the
replies are handled automagically, you just need to add a rule like

# by now the packet has been updated with a new destination, allow it in.

$IPTABLES -A FORWARD -p tcp --dst $SERVER_IP --dport 123 -j ACCEPT

BTW, these kind of questions are better directed to the user list, not the development list.

Cheers,
M4