DNAT problem

DNAT problem

[Patrick Leslie Polzer]

Hello again,

a DNAT problem is coming up.
My firewall setup (simplified for testing) is currently as follows:


### <snip> ###

##### FILTER table #####
# policies
$ipt -P FORWARD ACCEPT
$ipt -P   INPUT ACCEPT
$ipt -P  OUTPUT ACCEPT

$ipt -F
$ipt -F FORWARD
$ipt -F   INPUT
$ipt -F  OUTPUT


##### NAT table #####
# flush chains
$ipt -t nat -F  PREROUTING
$ipt -t nat -F POSTROUTING
$ipt -t nat -F      OUTPUT

# masquerading on ppp0 and vortex
$ipt -t nat -A POSTROUTING -o   ppp0 -j MASQUERADE
$ipt -t nat -A POSTROUTING -o vortex -j MASQUERADE

# dnat
$ipt -t nat -A PREROUTING -i ppp0 -p tcp --dport 80 -j DNAT --to-destination 192.168.35.191:80

### </snip> ###


The last line is working with

--dport 8080

but isn't with

--dport 80

What's going on there?


Kind regards,

Leslie

Re: DNAT problem

[Alexis]

i think it could be

- that the isp (if you're connecting to one isp trough ppp0) has a filter for
port 80 (it seems strange)

are you mangling some packets? what is the output for iptables -t mangle -L?



----- Original Message ----- 
From: "Patrick Leslie Polzer" <leslie.polzer@gmx.net>
To: <netfilter@lists.netfilter.org>
Sent: Saturday, May 29, 2004 12:25 PM
Subject: DNAT problem


>
> Hello again,
>
> a DNAT problem is coming up.
> My firewall setup (simplified for testing) is currently as follows:
>
>
> ### <snip> ###
>
> ##### FILTER table #####
> # policies
> $ipt -P FORWARD ACCEPT
> $ipt -P   INPUT ACCEPT
> $ipt -P  OUTPUT ACCEPT
>
> $ipt -F
> $ipt -F FORWARD
> $ipt -F   INPUT
> $ipt -F  OUTPUT
>
>
> ##### NAT table #####
> # flush chains
> $ipt -t nat -F  PREROUTING
> $ipt -t nat -F POSTROUTING
> $ipt -t nat -F      OUTPUT
>
> # masquerading on ppp0 and vortex
> $ipt -t nat -A POSTROUTING -o   ppp0 -j MASQUERADE
> $ipt -t nat -A POSTROUTING -o vortex -j MASQUERADE
>
> # dnat
> $ipt -t nat -A PREROUTING -i ppp0 -p tcp --dport 80 -j DNAT --to-destination
192.168.35.191:80
>
> ### </snip> ###
>
>
> The last line is working with
>
> --dport 8080
>
> but isn't with
>
> --dport 80
>
> What's going on there?
>
>
> Kind regards,
>
> Leslie
>
>

Re: DNAT problem

[Patrick Leslie Polzer]

On Sat, 29 May 2004 12:36:37 -0300
"Alexis" <alexis@tpys.com.ar> wrote:

> i think it could be
> 
> - that the isp (if you're connecting to one isp trough ppp0) has a filter for
> port 80 (it seems strange)
Hm, possible. I just noticed 81 works, too! What crap is this?

> are you mangling some packets? what is the output for iptables -t mangle -L?
No rules at all, I generally try to stay away from mangling when testing:


### <snip> ###

stronghold:~# iptables -t mangle -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination 

### </snip> ###


So I guess all facts are pointing at my crappy ISP...

Leslie

Re: DNAT problem

[Alexis]

to filter some ports is becoming a new "fashion" by the ISP.

The reason is "why he will serve a webserver if i can do this and charge some
fresh money for it"

just that


----- Original Message ----- 
From: "Patrick Leslie Polzer" <leslie.polzer@gmx.net>
To: <netfilter@lists.netfilter.org>
Sent: Saturday, May 29, 2004 1:03 PM
Subject: Re: DNAT problem


> On Sat, 29 May 2004 12:36:37 -0300
> "Alexis" <alexis@tpys.com.ar> wrote:
>
> > i think it could be
> >
> > - that the isp (if you're connecting to one isp trough ppp0) has a filter
for
> > port 80 (it seems strange)
> Hm, possible. I just noticed 81 works, too! What crap is this?
>
> > are you mangling some packets? what is the output for iptables -t mangle -L?
> No rules at all, I generally try to stay away from mangling when testing:
>
>
> ### <snip> ###
>
> stronghold:~# iptables -t mangle -L
> Chain PREROUTING (policy ACCEPT)
> target     prot opt source               destination
>
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination
>
> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination
>
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
>
> Chain POSTROUTING (policy ACCEPT)
> target     prot opt source               destination
>
> ### </snip> ###
>
>
> So I guess all facts are pointing at my crappy ISP...
>
> Leslie
>
>

OT: ISP Port filters (was: Re: DNAT problem)

[Patrick Leslie Polzer]

On Sat, 29 May 2004 22:00:03 -0300
"Alexis" <alexis@tpys.com.ar> wrote:

> to filter some ports is becoming a new "fashion" by the ISP.
> 
> The reason is "why he will serve a webserver if i can do this and charge some
> fresh money for it"
I'm really angry about this - blocking ports is one thing, but not telling
the customer about this and thereby giving him enormous headaches when
he tries to configure his network, another.

Well, enough ranting now.

Leslie