Port forwarding or NAT?

Port forwarding or NAT?

[Eric Geater 9/01/04]

I have one crazy machine at our home office that must communicate on
port 6847 to an outside company.  This one machine went through our old
proxy server until it died last week.  We're using IPTABLES through
rc.firewall-2.4 on a Linux proxy, but it doesn't seem to be allowing
this communication to occur.

Would this be handled through port forwarding or NAT?  I was under the
impression that our firewall was set up to allow all traffic, initated
from the LAN, through.  This apparently isn't the case, however.

Eric

Re: Port forwarding or NAT?

[Jason Opperisano]

On Tue, 2004-09-14 at 09:32, Eric Geater 9/01/04 wrote:
> I have one crazy machine at our home office that must communicate on
> port 6847 to an outside company.  This one machine went through our old
> proxy server until it died last week.  We're using IPTABLES through
> rc.firewall-2.4 on a Linux proxy, but it doesn't seem to be allowing
> this communication to occur.
> 
> Would this be handled through port forwarding or NAT?  

it would be handled by the FORWARD chain of the filter table, and by a
SNAT/MASQ rule in the POSTROUTING chain of the nat table.

-j

-- 
Jason Opperisano <opie@817west.com>

RE: Port forwarding or NAT?

[Rob Sterenborg]

netfilter-bounces@lists.netfilter.org wrote:
> I have one crazy machine at our home office that must
> communicate on port 6847 to an outside company.  This one
> machine went through our old proxy server until it died last
> week.  We're using IPTABLES through
> rc.firewall-2.4 on a Linux proxy, but it doesn't seem to be
> allowing this communication to occur.
> 
> Would this be handled through port forwarding or NAT?  I was
> under the impression that our firewall was set up to allow
> all traffic, initated from the LAN, through.  This apparently isn't
> the case, however. 

From inside (LAN) to outside (internet or something) = SNAT/MASQUERADE.
From outside to inside = DNAT (port forwarding).
In case of a proxy you'd probably be using Squid, and I doubt Squid will
let you communicate on port 6847.

I'm not familiar with the script so I can't say what's wrong.


Gr,
Rob

Re: Port forwarding or NAT?

[Alistair Tonner]

On September 14, 2004 09:32 am, Eric Geater 9/01/04 wrote:
> I have one crazy machine at our home office that must communicate on
> port 6847 to an outside company.  This one machine went through our old
> proxy server until it died last week.  We're using IPTABLES through
> rc.firewall-2.4 on a Linux proxy, but it doesn't seem to be allowing
> this communication to occur.
>
> Would this be handled through port forwarding or NAT?  I was under the
> impression that our firewall was set up to allow all traffic, initated
> from the LAN, through.  This apparently isn't the case, however.
>
> Eric

	Not knowing what the application that is communicating in this manner is, 
will make suggestions likely off the mark.

	if you are using the proxy server to handle *outgoing* connections using its 
INSIDE ip address, you need to accept packets from the LAN in INPUT chain, 
coming to the proxy.  You will then need to let packets OUT to the internet 
from the proxy to the internet through the OUTPUT chain.  You might well get 
away with appropriate ESTABLISHED RELATED rules to allow tarffic back, but it 
is possible that you will require additional rules to let traffic in from the 
other end.  I would hope that the proxy is smart enouh to handle NATTING the 
packets to the outside IP.

	if the proxy is accepting connections from the internet and proxying them to 
the LAN, you need to accept packets from the other end in via INPUT and allow 
packets to the internal box through OUTPUT,  again, an appropriate 
ESTABLISHED, RELATED rule *should* handle traffic on the return trip.  

	Since it sounds like the proxy and firewall are the same box, the FORWARD 
chain isnt likely to be involved here.  Thus letting all traffic from LAN 
through to internet will not work here.  You have to let the traffic from the 
LAN client INTO the firewall to get to the proxy.

	Alistair Tonner