DNAT doesn't work

DNAT doesn't work

[Holger Kinkelin]

Hi everybody!

I'm more or less new to netfilter / iptables; so I've got a question about DNAT.

My problem is, that my DNAT won't work. I want to reroute http-pakets
to server X to my own server running on localhost.

The first command I tried was the following:

>> iptables -A PREROUTING -t nat -p tcp -d [IP OF X] --dport 80 -j
DNAT --to-destination 127.0.0.1:80

The new rule seems to be added correctly to the nat-table:

>> iptables -t nat --list
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  anywhere             X tcp dpt:http to:127.0.0.1:80

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

But: There is no effect. When I try to open a page hostet on X, the
page loads from X, not from localhost...

So I tried

>> iptables -A PREROUTING -t nat -p tcp -d [IP OF X] --dport 80 -j REDIRECT

No effect, too

Could anybody tell me, what I'm doing wrong?
I'm using Suse Linux 10.0

Regards,
Holger

Re: DNAT doesn't work

[Guillaume]

Holger Kinkelin a écrit :
> Hi everybody!
> 
> I'm more or less new to netfilter / iptables; so I've got a question 
> about DNAT.
> 
> My problem is, that my DNAT won't work. I want to reroute http-pakets
> to server X to my own server running on localhost.
> 
> The first command I tried was the following:
> 
>>> iptables -A PREROUTING -t nat -p tcp -d [IP OF X] --dport 80 -j
> DNAT --to-destination 127.0.0.1:80
> 
> The new rule seems to be added correctly to the nat-table:
> 
>>> iptables -t nat --list
> Chain PREROUTING (policy ACCEPT)
> target     prot opt source               destination
> DNAT       tcp  --  anywhere             X tcp dpt:http to:127.0.0.1:80
> 
> Chain POSTROUTING (policy ACCEPT)
> target     prot opt source               destination
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> 
> But: There is no effect. When I try to open a page hostet on X, the
> page loads from X, not from localhost...
> 
> So I tried
> 
>>> iptables -A PREROUTING -t nat -p tcp -d [IP OF X] --dport 80 -j REDIRECT
> 
> No effect, too
> 
> Could anybody tell me, what I'm doing wrong?
> I'm using Suse Linux 10.0
> 
> Regards,
> Holger
> 

Hi,

The first thing I'm thinking about is that you need a corresponding rule 
in the "filter" table !

In this example, you should had a rule:
iptables -A INPUT -p tcp --dport 80 -d 127.0.0.1 -j ACCEPT

Of course, it's needed only if you set the default policy to "DROP" in 
all chains of table "filter".

So to summarize, after DNATing your traffic, you need to allow it in the 
filter table.

Regards
Guillaume


-- 
Guillaume
E-mail: silencer_<at>_free-4ever_<dot>_net
Blog: http://guillaume.free-4ever.net
----
Site: http://www.free-4ever.net

Re: DNAT doesn't work

[Guillaume]

Holger Kinkelin a écrit :
> Hi Guillaume
> 
> Thanx for your reply
> 
>> The first thing I'm thinking about is that you need a corresponding rule
>> in the "filter" table !
>>
>> In this example, you should had a rule:
>> iptables -A INPUT -p tcp --dport 80 -d 127.0.0.1 -j ACCEPT
>>
>> Of course, it's needed only if you set the default policy to "DROP" in
>> all chains of table "filter".
> hmmmm, ... no, the default policy is set to "ACCEPT"... Otherwise, I
> think, I coundn't open http://localhost in my webbrowser, too -- Or am
> I wrong?
> 
> Regards,
> Holger

hhhmmm...
It sounds you are right !

Don't know what to tell you at the moment....

Please post on the list more details like the network setup, and so on...


-- 
Guillaume
E-mail: silencer_<at>_free-4ever_<dot>_net
Blog: http://guillaume.free-4ever.net
----
Site: http://www.free-4ever.net

Re: DNAT doesn't work

[Pascal Hambourg]

Hello,

Holger Kinkelin a écrit :
> 
> I'm more or less new to netfilter / iptables; so I've got a question 
> about DNAT.
> 
> My problem is, that my DNAT won't work. I want to reroute http-pakets
> to server X to my own server running on localhost.
> 
> The first command I tried was the following:
> 
> iptables -A PREROUTING -t nat -p tcp -d [IP OF X] --dport 80 \
>   -j DNAT --to-destination 127.0.0.1:80

Don't DNAT connections from the outside to a loopback address. It won't 
work because the input routing, which takes place right after the 
PREROUTING chain, will drop packets to any destination in 127.0.0.0/8 
received on any interface other than lo. So you can only reach these 
destinations from the local host. Use the REDIRECT target instead, or 
DNAT to the local address of the input interface.

> But: There is no effect. When I try to open a page hostet on X, the
> page loads from X, not from localhost...
> 
> So I tried
> 
> iptables -A PREROUTING -t nat -p tcp -d [IP OF X] --dport 80 -j REDIRECT
> 
> No effect, too

If the source of the HTTP connection is the local host, you must put 
this rule in the OUTPUT chain instead of PREROUTING. By the way, you can 
use "DNAT --to 127.0.0.1" this time, because it's a local host 
communication. Make sure trafic on the interface lo is allowed.