From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Fernando La Gamba" Subject: redirect connec to ex int to int Date: Tue, 22 Jul 2003 15:08:10 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <00bf01c3507c$35db5800$6200000a@detec10> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_00BB_01C35063.1072A8C0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_00BB_01C35063.1072A8C0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I'm trying to redirect connections from outside (external interface) to a internal machine (192.168.200.252), but i dont know why, nothing happend. Someone can tell me whats wrong with this rules? #!/bin/bash export IPTABLES=3D/usr/local/sbin/iptables export MODPROBE=3D/sbin/modprobe $MODPROBE ip_nat_ftp $MODPROBE ip_conntrack $MODPROBE ip_conntrack_ftp $MODPROBE ipt_string echo 1 > /proc/sys/net/ipv4/ip_forward $IPTABLES -F $IPTABLES -F -t nat $IPTABLES -F -t mangle $IPTABLES -X $IPTABLES -Z echo "- Enabling SNAT (MASQUERADE) funtionality on eth0" # IF_EXT=3Deth0 IF_INT=3Deth1 # # ANY=3D0.0.0.0/0 NET_INT=3D192.168.0.0/16 # # IP_WEB_INT=3D192.168.200.252 IP_WEB_EXT=3D200.X.X.X # $IPTABLES -N EXT_SRVWEB $IPTABLES -A EXT_SRVWEB -p tcp -s $ANY --sport 1024: -d $IP_WEB_INT --dport 10001 -i $IF_EXT -o $IF_INT -j ACCEPT $IPTABLES -A EXT_SRVWEB -j DROP $IPTABLES -N SRVWEB_EXT $IPTABLES -A SRVWEB_EXT -p tcp -s $IP_WEB_INT --sport 10001 -d $ANY --dport 1024: -i $IF_INT -o $IF_EXT -j ACCEPT $IPTABLES -A SRVWEB_EXT -j DROP $IPTABLES -t nat -A PREROUTING -d $IP_WEB_EXT -j DNAT --to $IP_WEB_INT -i $IF_EXT $IPTABLES -A FORWARD -j EXT_SRVWEB -s $ANY -d $IP_WEB_INT -i $IF_EXT -o $IF_INT $IPTABLES -A FORWARD -j SRVWEB_EXT -s $IP_WEB_INT -d $ANY -i $IF_INT -o $IF_EXT $IPTABLES -A POSTROUTING -t nat -s $IP_WEB_INT -d $ANY -j SNAT --to $IP_WEB_EXT -o $IF_EXT $IPTABLES -A POSTROUTING -t nat -j MASQUERADE -s $NET_INT -o $IF_EXT Thanks ____________________________ Fastrack Solu=E7=F5es e Sistemas Fernando La Gamba Network Admin / Security Com.: 5506-6044 R. 614 Cel.: 9214-2176 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.501 / Virus Database: 299 - Release Date: 14/7/2003 ------=_NextPart_000_00BB_01C35063.1072A8C0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

I'm trying to redirect connections from = outside=20 (external interface) to a internal machine (192.168.200.252), but i dont = know=20 why, nothing happend.

Someone can tell me whats wrong with = this=20 rules?

#!/bin/bash

export = IPTABLES=3D/usr/local/sbin/iptables
export=20 MODPROBE=3D/sbin/modprobe

$MODPROBE ip_nat_ftp
$MODPROBE=20 ip_conntrack
$MODPROBE ip_conntrack_ftp
$MODPROBE = ipt_string
echo 1=20 > /proc/sys/net/ipv4/ip_forward

$IPTABLES -F
$IPTABLES -F -t = nat
$IPTABLES -F=20 -t mangle
$IPTABLES -X
$IPTABLES -Z

echo "- Enabling SNAT (MASQUERADE) = funtionality on=20 eth0"

#<INTERFACES>
IF_EXT=3Deth0
IF_INT=3Deth1
#</I= NTERFACES>

#<REDES>
ANY=3D0.0.0.0/0
NET_INT=3D192.168.0.0/16#</REDES>

#<sERVIDOR=20 WEB>
IP_WEB_INT=3D192.168.200.252
IP_WEB_EXT=3D200.X.X.X
#<= ;/sERVIDOR=20 WEB>

$IPTABLES -N EXT_SRVWEB
$IPTABLES -A EXT_SRVWEB -p tcp -s = $ANY=20 --sport 1024: -d $IP_WEB_INT --dport 10001 -i $IF_EXT -o $IF_INT -j=20 ACCEPT
$IPTABLES -A EXT_SRVWEB -j DROP

$IPTABLES -N SRVWEB_EXT
$IPTABLES -A SRVWEB_EXT -p tcp -s = $IP_WEB_INT=20 --sport 10001 -d $ANY --dport 1024: -i $IF_INT -o $IF_EXT -j = ACCEPT
$IPTABLES=20 -A SRVWEB_EXT -j DROP

$IPTABLES -t nat -A PREROUTING -d $IP_WEB_EXT -j DNAT --to = $IP_WEB_INT -i=20 $IF_EXT

$IPTABLES -A FORWARD -j EXT_SRVWEB -s = $ANY -d=20 $IP_WEB_INT -i $IF_EXT -o $IF_INT
$IPTABLES -A FORWARD -j SRVWEB_EXT = -s=20 $IP_WEB_INT -d $ANY -i $IF_INT -o = $IF_EXT

$IPTABLES -A POSTROUTING -t nat -s $IP_WEB_INT -d $ANY -j SNAT --to = $IP_WEB_EXT -o $IF_EXT
$IPTABLES -A POSTROUTING -t nat -j MASQUERADE = -s=20 $NET_INT -o $IF_EXT

Thanks

____________________________
Fastrack Solu=E7=F5es e=20 Sistemas
Fernando La Gamba
Network Admin / Security
Com.: = 5506-6044 R.=20 614
Cel.: 9214-2176

---
Outgoing mail is certified = Virus=20 Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: = 6.0.501 /=20 Virus Database: 299 - Release Date: 14/7/2003

------=_NextPart_000_00BB_01C35063.1072A8C0--