Help on port forwarding + Origin and Destination IP rewriting...

Help on port forwarding + Origin and Destination IP rewriting...

[luisccmail-netfilter]

  Dear Netfilter list people

  I'm trying to build some netfilter rules so my linux box can forward a telnet connection made on
a machine on my network (lets say "Box-A") to another machine in my network (lets say "Box-B").

  Box-A is just another server in the network, but Box-B is special: its a firewalled access
gateway to a client's network, and it is setted up in a way that only telnet connections from
Box-A are accepted (that's my client's security policy, and I don't have any chances on change
this).

  On the other hand, many folks from my company need access to that client network, and I don't
want everybuddy needing access to Box-B to connect on Box-A (thats local security policy).
 
 So I tried to use two simple rules that could allow me to forward the connections:

  ###################################
  # /etc/hosts file
  # This aliases are in /etc/hosts format, to easy comprehension
  box-a.local 192.168.0.6
  box-b.local 192.168.0.34
  # EOF #############################

  ###################################
  # Redirection script file
  # This should re-write incomming connections before routing
  # after routing process, they should go to the right host.
  iptables -t nat -A PREROUTING -p tcp \
           -d box-a.local --destination-port 2200 \
           --jump DNAT --to-destination box-b.local:2222

  # This should re-write outgoing connections after routing,
  # so they appear to originate from the Box-A host.
  iptables -t nat -A POSTROUTING -p tcp \
           -d box-b.local --destination-port 2222 \
           --jump SNAT --to-source box-a.local
  # EOF #############################

  Oh, well, now begin my problem: this doesn't work, and I don't have any ideas to correct the
problem. I even know what is broken, sadly... :-/ Please help me.

  Thank you all very much for desining, maintaining and supporting such a nice tool like
Netfilter. 

  Best regards.


	



	
		
_______________________________________________________ 
Yahoo! Acesso Grátis: Internet rápida e grátis. 
Instale o discador agora!
http://br.acesso.yahoo.com/

Re: Help on port forwarding + Origin and Destination IP rewriting...

[/dev/rob0]

On Thursday 2005-November-10 08:14, luisccmail-netfilter@yahoo.com.br 
wrote:
>   iptables -t nat -A PREROUTING -p tcp \
>            -d box-a.local --destination-port 2200 \
>            --jump DNAT --to-destination box-b.local:2222
>
>   # This should re-write outgoing connections after routing,
>   # so they appear to originate from the Box-A host.
>   iptables -t nat -A POSTROUTING -p tcp \
>            -d box-b.local --destination-port 2222 \
>            --jump SNAT --to-source box-a.local
>   # EOF #############################
>
>   Oh, well, now begin my problem: this doesn't work, and I don't have

iptables won't resolve names in --to-(source|destination) arguments. 
Hint: when the man page says "ipaddr" for an argument it means you must 
use numeric dotted quad IP addresses, not gethostbyname() or DNS names.

If you want to retain control of name-to-address mapping, use a bit of 
shell code in `` backticks to extract your IP address. Yours would be a 
grep(1) and cut(1)[1] job. Or if you use DNS names, dig(1):
    `dig +short name.fqdn`
That will return just the IP if there is a single "A" record for 
"name.fqdn".



[1] /bin/cut is easy, but it invokes another process. If you're using 
bash(1) there are numerous ways to slice and dice the output of your 
grep(1) command all within the presently running shell. I'm a bit hazy 
on the details and it's off topic here anyway. :) Use whichever is 
easiest for you; just be aware that the bash way is a tiny bit better.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: Help on port forwarding + Origin and Destination IP rewriting...

[Jörg Harmuth]

luisccmail-netfilter@yahoo.com.br schrieb:
>   Dear Netfilter list people
> 
>   I'm trying to build some netfilter rules so my linux box can forward a telnet connection made on
> a machine on my network (lets say "Box-A") to another machine in my network (lets say "Box-B").
> 
>   Box-A is just another server in the network, but Box-B is special: its a firewalled access
> gateway to a client's network, and it is setted up in a way that only telnet connections from
> Box-A are accepted (that's my client's security policy, and I don't have any chances on change
> this).
> 
>   On the other hand, many folks from my company need access to that client network, and I don't
> want everybuddy needing access to Box-B to connect on Box-A (thats local security policy).
>  
>  So I tried to use two simple rules that could allow me to forward the connections:
> 
>   ###################################
>   # /etc/hosts file
>   # This aliases are in /etc/hosts format, to easy comprehension
>   box-a.local 192.168.0.6
>   box-b.local 192.168.0.34
>   # EOF #############################
> 
>   ###################################
>   # Redirection script file
>   # This should re-write incomming connections before routing
>   # after routing process, they should go to the right host.
>   iptables -t nat -A PREROUTING -p tcp \
>            -d box-a.local --destination-port 2200 \
>            --jump DNAT --to-destination box-b.local:2222
> 
>   # This should re-write outgoing connections after routing,
>   # so they appear to originate from the Box-A host.
>   iptables -t nat -A POSTROUTING -p tcp \
>            -d box-b.local --destination-port 2222 \
>            --jump SNAT --to-source box-a.local
>   # EOF #############################
> 
>   Oh, well, now begin my problem: this doesn't work, and I don't have any ideas to correct the
> problem. 

The information you provide is not sufficient to troubleshoot your
problem. If you could provide the output of iptables-save and some other
information that may help...

Your two rules seem to be ok. Some things you may check:

is /proc/sys/net/ipv4/ip_forward set to 1 ?
is routing setup correctly ?
is FORWARD policy DROP ? And if so, is there a rule that permits
   -d box-b.local --dport 2222 ?
are there any other rules in any table / chain that may cause the
    problem ?
what does tcpdump tell you about a connection attempt ?

That should give some hints.

HTH,

Joerg