no connection

no connection

[William Perry]

I am using the following iptables script:
# eth0 is the Local network
# eth1 is the External network
 
*filter
:INPUT   DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT  DROP [0:0]
 
#allow traffic from the firewall to go out
-A FORWARD -i eth0 -o eth1 -j ACCEPT
-A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
 
# allow local loopback connections
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
 
# Allow all connections to the local network
-A INPUT -i eth0 -s 123.123.123.0/24 -j ACCEPT
-A OUTPUT -o eth0 -d 123.123.123.0/24 -j ACCEPT
 
# drop INVALID connections
-A INPUT   -m state --state INVALID -j DROP
-A OUTPUT  -m state --state INVALID -j DROP
-A FORWARD -m state --state INVALID -j DROP
 
# allow all established and related
-A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
 
# allow connectionsto my ISP's DNS servers
-A OUTPUT   -d 206.13.31.12 -m state --state NEW -p udp --dport 53 -o 
eth1 -j ACCEPT
-A FORWARD  -d 206.13.31.12 -m state --state NEW -p udp --dport 53 -i 
eth0 -o eth1 -j ACCEPT
 
-A OUTPUT   -d 206.13.28.12 -m state --state NEW -p udp --dport 53 -o 
eth1 -j ACCEPT
-A FORWARD  -d 206.13.28.12 -m state --state NEW -p udp --dport 53 -i 
eth0 -o eth1 -j ACCEPT
 
# allow outgoing conections web servers
-A OUTPUT  -d 0/0 -m state --state NEW,ESTABLISHED,RELATED -p tcp 
--dport http -o eth1 -j ACCEPT
-A FORWARD -d 0/0 -m state --state NEW,ESTABLISHED,RELATED -p tcp 
--dport http -o eth1 -i eth0 -j ACCEPT
 
-A OUTPUT  -d 0/0 -m state --state NEW,ESTABLISHED,RELATED -p tcp 
--dport https -o eth1 -j ACCEPT
-A FORWARD -d 0/0 -m state --state NEW,ESTABLISHED,RELATED -p tcp 
--dport https -o eth1 -i eth0 -j ACCEPT
 
# allow outgoing conections ntp
-A OUTPUT  -d 0/0 -m state --state NEW,ESTABLISHED,RELATED -p tcp 
--dport 123 -o eth1 -j ACCEPT
-A FORWARD -d 0/0 -m state --state NEW,ESTABLISHED,RELATED -p tcp 
--dport 123 -o eth1 -i eth0 -j ACCEPT
 
# Log all other attempts to out-going connection
-A OUTPUT   -o eth1 -j LOG --log-level info --log-prefix "[ATTEMPTED] "
-A FORWARD  -o eth1 -j ACCEPT
 
-A FORWARD  -j LOG --log-level info --log-prefix "[FWD-] "
-A FORWARD  -o eth0 -j ACCEPT
 
COMMIT
 
*nat
-A POSTROUTING -o eth1 -j SNAT --to 71.133.232.116
 
#port forward port 80
-A PREROUTING -d 71.133.232.116 -i eth1 -p tcp -m tcp --dport 80 -j DNAT 
--to-destination 123.123.123.2:80
 
COMMIT
 
#----
I was expecting the firewall (external ip 71.133.232.116) to send the 
packets to the web server (123.123.123.2), but it appears that the 
packets are not going anywhere.

Test:
use a machine whose gateway is not 71.133.232.116 and execute:
wget http://71.133.232.116/

1. On the log file of the firewall, I see a log record indicating that 
the "[FWD-]" log was hit.
2. On the web server, I see no record in the access log file.
3. No response is received to the wget command.

Isn't the prerouting command enough to get the packets to go? What do I 
need to do to get iptables to actually send the packet?
-- 
William Perry