Port forwarding on host interface

Port forwarding on host interface

[Daniel Huhardeaux]

Hi all,

I would like to redirect an external port to another port on the same 
machine. I read on some documents that the kernel doesn't allow DNAT to 
127.0.0.1 so I ended up with following setup:

let's say I want to redirect 59000 port on my 1.2.3.4 public IP to 5900 
port on the same public IP *but a direct connection to 5900 port on the 
public IP* is forbidden. At this time my packets are marked for iproute2 
(2 ISP), mark 201 (isp1) or 202 (Isp2).

Has someone a tip for me? Is it true that forwarding to 127.0.0.1 can't 
be done?

Thanks for any hint.

-- 
Daniel Huhardeaux       _____ ____ ____ _____ _____ _
enum   +33 368 460 088 (_  __) _  ) _  (_  __) _  _(_)  +48 222 472 472
iaxtel  1-700-849-6983  / / / // / // / / / / /_/ / /  GIZMO,SKYPE,GTALK
sip/iax:callto 101@sip./_/ ( ___( ___/ /_/ (_/ (_/_/.net   tootaiNET

Re: Port forwarding on host interface

[Mart Frauenlob]

netfilter-owner@vger.kernel.org wrote:
> Hi all,
>
> I would like to redirect an external port to another port on the same 
> machine. I read on some documents that the kernel doesn't allow DNAT 
> to 127.0.0.1 so I ended up with following setup:
>
> let's say I want to redirect 59000 port on my 1.2.3.4 public IP to 
> 5900 port on the same public IP *but a direct connection to 5900 port 
> on the public IP* is forbidden. At this time my packets are marked for 
> iproute2 (2 ISP), mark 201 (isp1) or 202 (Isp2).
>
> Has someone a tip for me? Is it true that forwarding to 127.0.0.1 
> can't be done?
>
> Thanks for any hint.
>
Hello,

take a look at the REDIRECT target.

Regards

Mart

Re: Port forwarding on host interface

[Pascal Hambourg]

Daniel Huhardeaux a écrit :
> 
> I would like to redirect an external port to another port on the same 
> machine.

REDIRECT is your friend.

> I read on some documents that the kernel doesn't allow DNAT to 
> 127.0.0.1 so I ended up with following setup:

This is not exactly right. NAT allows any address you like, but the
kernel routing prohibits packets with an address in the loopback range
on a non-loopback interface, regardless of NAT. It might be worth
mentionning that the routing decision occurs after the PREROUTING chain
and does not know about the original destination address. However DNAT
to 127.x.y.z works fine in the OUTPUT chain because the packets are
rerouted through the loopback interface and don't leave the host.

> let's say I want to redirect 59000 port on my 1.2.3.4 public IP to 5900 
> port on the same public IP *but a direct connection to 5900 port on the 
> public IP* is forbidden. At this time my packets are marked for iproute2 
> (2 ISP), mark 201 (isp1) or 202 (Isp2).
> 
> Has someone a tip for me?

You can drop packets to port 5900 in the mangle table before the nat
table. Or you can mark them in the mangle table and drop or reject them
later in the filter table (preferred).

> Is it true that forwarding to 127.0.0.1 can't be done?

If you mean IP forwarding, yes, for the same reason as above because IP
forwarding involves non-loopback interfaces. Note that what you want to
do is not IP forwarding.

If you mean what is commonly called "port forwarding" which is a form of
destination NAT, you can use loopback addresses as long as packets don't
leave or enter the host. As I wrote above, DNAT to 127.x.y.z works fine
in the OUTPUT chain.

Re: Port forwarding on host interface

[Daniel Huhardeaux]

Pascal Hambourg a écrit :

Good day,
> Daniel Huhardeaux a écrit :
>> I would like to redirect an external port to another port on the same 
>> machine.
>
> REDIRECT is your friend.
Thanks to Mart and you I got it work :-)
>> I read on some documents that the kernel doesn't allow DNAT to 
>> 127.0.0.1 so I ended up with following setup:
>
> This is not exactly right. NAT allows any address you like, but the
> kernel routing prohibits packets with an address in the loopback range
> on a non-loopback interface, regardless of NAT. It might be worth
> mentionning that the routing decision occurs after the PREROUTING chain
> and does not know about the original destination address. However DNAT
> to 127.x.y.z works fine in the OUTPUT chain because the packets are
> rerouted through the loopback interface and don't leave the host.
My rules are:
            [snip]

            [ -z $IP   ] && 
IP=$EXTERNAL_MAIN_IP                                                                                    

            [ -z $PORT ] && 
PORT=$EXT_PORT                                                                                          


            $IPTABLES -t mangle -A PREROUTING   -p tcp  -i 
$EXTERNAL_MAIN_DEVICE -d $EXTERNAL_MAIN_NET  --dport $PORT           -j 
                    DROP

            if [ "$IP" == "$EXTERNAL_MAIN_IP" ]; then
                $IPTABLES -t nat        -A PREROUTING   -p tcp  -i 
$EXTERNAL_MAIN_DEVICE -d $IP         --dport $EXT_PORT       -j         
                REDIRECT --to-port $PORT
                $IPTABLES               -A INPUT        -p tcp  -i 
$EXTERNAL_MAIN_DEVICE -d $IP         --dport $PORT           -j         
                ACCEPT                 
            else
                # To inhibed when IP is 127.0.0.1               
                $IPTABLES -t nat -A PREROUTING  -p tcp  -i 
$EXTERNAL_MAIN_DEVICE -d $EXTERNAL_MAIN_NET  --dport $EXT_PORT       -j 
                        DNAT --to $IP:$PORT    
                $IPTABLES        -A FORWARD     -p tcp  -m 
tcp                                          --dport $PORT           -j 
                        ACCEPT                 
                # Test for redirection to localhost, to activate when IP 
is 127.0.0.1                                 
                #$IPTABLES -t nat -A OUTPUT     -p tcp  -o 
$EXTERNAL_MAIN_DEVICE        -d $IP          --dport $EXT_PORT       -j 
                        DNAT --to $IP:$PORT
                #$IPTABLES       -A [INPUT|FORWARD]     -p tcp  -m 
tcp                                  --dport $PORT           -j         
            ACCEPT
            fi

This is working fine when $IP is the public one or the Intranet one. But 
when I put the localhost 127.0.0.1 and activate the right stuff, it's 
not working (tried with both INPUT and FORWARD). Telnet to the EXT_PORT 
shows try to connect ... From the host, telnet localhost $PORT is working.

Concerning mark of packets, as I told in my original mail, they are 
already marked in the mangle table, prerouting rule for my 2 ISP. I 
tried to find a solution with save/restore but problem is that mangle 
can't use user define target, so how to restore original mark AND accept 
the packet?

Thanks to you and Mart for your time

-- 
Daniel Huhardeaux       _____ ____ ____ _____ _____ _
enum   +33 368 460 088 (_  __) _  ) _  (_  __) _  _(_)  +48 222 472 472
iaxtel  1-700-849-6983  / / / // / // / / / / /_/ / /  GIZMO,SKYPE,GTALK
sip/iax:callto 101@sip./_/ ( ___( ___/ /_/ (_/ (_/_/.net   tootaiNET