Re: DNAT doesn't work

[Guillaume <silencer@free-4ever.net>]

Holger Kinkelin a écrit :
> Hi everybody!
> 
> I'm more or less new to netfilter / iptables; so I've got a question 
> about DNAT.
> 
> My problem is, that my DNAT won't work. I want to reroute http-pakets
> to server X to my own server running on localhost.
> 
> The first command I tried was the following:
> 
>>> iptables -A PREROUTING -t nat -p tcp -d [IP OF X] --dport 80 -j
> DNAT --to-destination 127.0.0.1:80
> 
> The new rule seems to be added correctly to the nat-table:
> 
>>> iptables -t nat --list
> Chain PREROUTING (policy ACCEPT)
> target     prot opt source               destination
> DNAT       tcp  --  anywhere             X tcp dpt:http to:127.0.0.1:80
> 
> Chain POSTROUTING (policy ACCEPT)
> target     prot opt source               destination
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> 
> But: There is no effect. When I try to open a page hostet on X, the
> page loads from X, not from localhost...
> 
> So I tried
> 
>>> iptables -A PREROUTING -t nat -p tcp -d [IP OF X] --dport 80 -j REDIRECT
> 
> No effect, too
> 
> Could anybody tell me, what I'm doing wrong?
> I'm using Suse Linux 10.0
> 
> Regards,
> Holger
> 

Hi,

The first thing I'm thinking about is that you need a corresponding rule 
in the "filter" table !

In this example, you should had a rule:
iptables -A INPUT -p tcp --dport 80 -d 127.0.0.1 -j ACCEPT

Of course, it's needed only if you set the default policy to "DROP" in 
all chains of table "filter".

So to summarize, after DNATing your traffic, you need to allow it in the 
filter table.

Regards
Guillaume


-- 
Guillaume
E-mail: silencer_<at>_free-4ever_<dot>_net
Blog: http://guillaume.free-4ever.net
----
Site: http://www.free-4ever.net