internal web server

internal web server

[Fritz Mesedilla]

Greetings!
I can't seem to make this work...

- external ip of firewall 202.138.128.xxx
- internal ip of firewall 192.168.247.3
- internal web server with ip 192.168.247.5

This was what my code was...
$IPT -t nat -A PREROUTING -p tcp -d 192.168.247.3 --dport 80 -j DNAT --to-destination 192.168.247.5:80

It doesn't seem to work. I have set the web server to use the gw of 192.168.247.3


Hope you can help me. Thanks.

fritz <www.mesedilla.com>
---
+ Basta Ikaw Lord

----------------------------------------------------------------------
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender immediately by e-mail and delete this e-mail from your
system. Please note that any views or opinions presented in this
email are solely those of the author and do not necessarily represent
those of the company. Finally, the recipient should check this email
and any attachments for the presence of viruses. The company accepts
no liability for any damage caused by any virus transmitted by this
email. 

Overture Media, Inc.
Direct Line: (632) 635-4785
Trunkline:   (632) 631-8971 Local 146
Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. Ortigas Ave., Quezon City 1100

Re: internal web server

[Thorsten Scherf]

>- external ip of firewall 202.138.128.xxx
>- internal ip of firewall 192.168.247.3
>- internal web server with ip 192.168.247.5
>
>This was what my code was...
>$IPT -t nat -A PREROUTING -p tcp -d 192.168.247.3 --dport 80 -j DNAT
> --to-destination 192.168.247.5:80
>
>It doesn't seem to work. I have set the web server to use the gw of
> 192.168.247.3

Not really sure what you want, but if you try to write a rule for forwarding 
packets which destination Port 80 to your internal web server, try this 
one:

$IPT -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 
192.168.247.5:80

If you know your external fw-IP you can specify it in the rule:

$IPT -t nat -A PREROUTING -p tcp --dport 80 -d 202.138.128.xxx -j DNAT 
--to-destination 192.168.247.5:80


Greetings,

Thorsten Scherf,
RHCE, RHCX

RE: internal web server

[Fritz Mesedilla]

I have tried both.
I used "iptables -nvL" and saw that there were like 2 packets each attempt to access the web server. But gets no reply. :D


fritz <www.mesedilla.com>
---
+ Basta Ikaw Lord



> -----Original Message-----
> From: Thorsten Scherf [mailto:tscherf@web.de]
> Sent: Friday, September 05, 2003 9:58 PM
> To: Fritz Mesedilla; netfilter@lists.netfilter.org
> Subject: Re: internal web server
> 
> 
> >- external ip of firewall 202.138.128.xxx
> >- internal ip of firewall 192.168.247.3
> >- internal web server with ip 192.168.247.5
> >
> >This was what my code was...
> >$IPT -t nat -A PREROUTING -p tcp -d 192.168.247.3 --dport 80 -j DNAT
> > --to-destination 192.168.247.5:80
> >
> >It doesn't seem to work. I have set the web server to use the gw of
> > 192.168.247.3
> 
> Not really sure what you want, but if you try to write a rule 
> for forwarding 
> packets which destination Port 80 to your internal web 
> server, try this 
> one:
> 
> $IPT -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 
> 192.168.247.5:80
> 
> If you know your external fw-IP you can specify it in the rule:
> 
> $IPT -t nat -A PREROUTING -p tcp --dport 80 -d 
> 202.138.128.xxx -j DNAT 
> --to-destination 192.168.247.5:80
> 
> 
> Greetings,
> 
> Thorsten Scherf,
> RHCE, RHCX
> 
> 

----------------------------------------------------------------------
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender immediately by e-mail and delete this e-mail from your
system. Please note that any views or opinions presented in this
email are solely those of the author and do not necessarily represent
those of the company. Finally, the recipient should check this email
and any attachments for the presence of viruses. The company accepts
no liability for any damage caused by any virus transmitted by this
email. 

Overture Media, Inc.
Direct Line: (632) 635-4785
Trunkline:   (632) 631-8971 Local 146
Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. Ortigas Ave., Quezon City 1100

Re: internal web server

[slack geek]

Hello fritz,

You have only one mistake in your iptables command. Since you're making DNAT and you're refering to firewall's _external_ ip to connect 
to to the internal web server, it's right to do it like this:

EXT_IFACE = your external network interface ( eth0 for example )
EXT_IP = the ip address attached to your $EXT_IFACE
INT_WWW_IP = your web server ip address

iptables -t nat -A PREROUTING -p tcp -i $EXT_IFACE -d $EXT_IP --dport 80 -j DNAT --to-destination $INT_WWW_IP:80


Cheers, train.

On Fri, 5 Sep 2003 20:57:51 +0800
"Fritz Mesedilla" <fritz.mesedilla@overturemedia.com> wrote:

> 
> Greetings!
> I can't seem to make this work...
> 
> - external ip of firewall 202.138.128.xxx
> - internal ip of firewall 192.168.247.3
> - internal web server with ip 192.168.247.5
> 
> This was what my code was...
> $IPT -t nat -A PREROUTING -p tcp -d 192.168.247.3 --dport 80 -j DNAT --to-destination 192.168.247.5:80
> 
> It doesn't seem to work. I have set the web server to use the gw of 192.168.247.3
> 
> 
> Hope you can help me. Thanks.
> 
> fritz <www.mesedilla.com>
> ---
> + Basta Ikaw Lord
> 
> ----------------------------------------------------------------------
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the sender immediately by e-mail and delete this e-mail from your
> system. Please note that any views or opinions presented in this
> email are solely those of the author and do not necessarily represent
> those of the company. Finally, the recipient should check this email
> and any attachments for the presence of viruses. The company accepts
> no liability for any damage caused by any virus transmitted by this
> email. 
> 
> Overture Media, Inc.
> Direct Line: (632) 635-4785
> Trunkline:   (632) 631-8971 Local 146
> Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. Ortigas Ave., Quezon City 1100
> 
> 

RE: internal web server

[Fritz Mesedilla]

Thank you so much for replying!
I have tried your suggestion as well as Thorten's suggestion but it still does not work!

By the way, there is a router in front of all this. Does this have an effect on the natting?

router - firewall - web server

I don't want to use the router to route traffic directly to the web server as I want all traffic to enter the firewall.
It somehow means there is a double nat that happens.

- router translates 202.138.128.xxx to 192.168.247.3 (firewall internal ip)
- firewall hopes to translate 192.168.247.3 port 80 traffic to 192.168.247.5 (web server internal ip) port 80

When I use the old one like:
iptables -t nat -A PREROUTING -p tcp -d 192.168.247.3 --dport 80 -j DNAT --to-destination 192.168.247.5:80

I see this:
[clause@fw firewall]# iptables -nvL -t nat
Chain PREROUTING (policy ACCEPT 3318K packets, 1243M bytes)
 pkts bytes target     prot opt in     out     source               destination
   21  1008 DNAT       tcp  --  *      *       0.0.0.0/0            192.168.247.3      tcp dpt:80 to:192.168.247.5:80

So I feel that the nat somehow works. I just don't receive any packets on the web server.

I hope you can help me again!

Thanks again for helping me.


fritz <www.mesedilla.com>
---
+ Basta Ikaw Lord



> -----Original Message-----
> From: slack geek [mailto:slack_geek@mail.bulgaria.com]
> Sent: Friday, September 05, 2003 10:32 PM
> To: netfilter@lists.netfilter.org
> Subject: Re: internal web server
> 
> 
> Hello fritz,
> 
> You have only one mistake in your iptables command. Since 
> you're making DNAT and you're refering to firewall's 
> _external_ ip to connect 
> to to the internal web server, it's right to do it like this:
> 
> EXT_IFACE = your external network interface ( eth0 for example )
> EXT_IP = the ip address attached to your $EXT_IFACE
> INT_WWW_IP = your web server ip address
> 
> iptables -t nat -A PREROUTING -p tcp -i $EXT_IFACE -d $EXT_IP 
> --dport 80 -j DNAT --to-destination $INT_WWW_IP:80
> 
> 
> Cheers, train.
> 
> On Fri, 5 Sep 2003 20:57:51 +0800
> "Fritz Mesedilla" <fritz.mesedilla@overturemedia.com> wrote:
> 
> > 
> > Greetings!
> > I can't seem to make this work...
> > 
> > - external ip of firewall 202.138.128.xxx
> > - internal ip of firewall 192.168.247.3
> > - internal web server with ip 192.168.247.5
> > 
> > This was what my code was...
> > $IPT -t nat -A PREROUTING -p tcp -d 192.168.247.3 --dport 
> 80 -j DNAT --to-destination 192.168.247.5:80
> > 
> > It doesn't seem to work. I have set the web server to use 
> the gw of 192.168.247.3
> > 
> > 
> > Hope you can help me. Thanks.
> > 
> > fritz <www.mesedilla.com>
> > ---
> > + Basta Ikaw Lord
> > 
> > 
> ----------------------------------------------------------------------
> > This email and any files transmitted with it are confidential and
> > intended solely for the use of the individual or entity to whom they
> > are addressed. If you have received this email in error 
> please notify
> > the sender immediately by e-mail and delete this e-mail from your
> > system. Please note that any views or opinions presented in this
> > email are solely those of the author and do not necessarily 
> represent
> > those of the company. Finally, the recipient should check this email
> > and any attachments for the presence of viruses. The company accepts
> > no liability for any damage caused by any virus transmitted by this
> > email. 
> > 
> > Overture Media, Inc.
> > Direct Line: (632) 635-4785
> > Trunkline:   (632) 631-8971 Local 146
> > Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. 
> Ortigas Ave., Quezon City 1100
> > 
> > 
> 
> 
> 
> 

----------------------------------------------------------------------
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender immediately by e-mail and delete this e-mail from your
system. Please note that any views or opinions presented in this
email are solely those of the author and do not necessarily represent
those of the company. Finally, the recipient should check this email
and any attachments for the presence of viruses. The company accepts
no liability for any damage caused by any virus transmitted by this
email. 

Overture Media, Inc.
Direct Line: (632) 635-4785
Trunkline:   (632) 631-8971 Local 146
Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. Ortigas Ave., Quezon City 1100