Linux Netfilter discussions
 help / color / mirror / Atom feed
* RE: Port forward
@ 2003-02-04 10:56 ASC - Ronald Roeleveld
  2003-02-04 11:17 ` RE : " Franck
  2003-02-04 11:53 ` Sven Schuster
  0 siblings, 2 replies; 11+ messages in thread
From: ASC - Ronald Roeleveld @ 2003-02-04 10:56 UTC (permalink / raw)
  To: 'Eric Leblond'; +Cc: 'netfilter@lists.netfilter.org'

[-- Attachment #1: Type: text/plain, Size: 2918 bytes --]

Thanks a lot the error message is gone now,
after I changed the line to:
iptables -t nat -A PREROUTING -p tcp --destination-port 25 -i eth0 -j DNAT
--to-destination 192.168.22.6:25

But when I do iptables --list
I dont see any entrys in the chain for PREROUTING

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  192.168.32.6         anywhere           tcp dpt:ssh
ACCEPT     udp  --  192.168.32.6         anywhere           udp dpt:ssh
ACCEPT     tcp  --  192.168.22.6         anywhere           tcp dpt:ssh
ACCEPT     udp  --  192.168.22.6         anywhere           udp dpt:ssh
ACCEPT     tcp  --  thamaster.xs4all.nl  anywhere           tcp dpt:ssh
ACCEPT     udp  --  thamaster.xs4all.nl  anywhere           udp dpt:ssh
ACCEPT     tcp  --  192.168.22.0/24      anywhere           tcp dpt:www
ACCEPT     udp  --  192.168.22.0/24      anywhere           udp dpt:www
ACCEPT     tcp  --  localnet/24          anywhere           tcp dpt:www
ACCEPT     udp  --  localnet/24          anywhere           udp dpt:www
ACCEPT     all  --  anywhere             anywhere
DROP       tcp  --  anywhere             anywhere           tcp
flags:SYN,RST,ACK/SYN

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
TCPMSS     tcp  --  anywhere             anywhere           tcp
flags:SYN,RST/SYN TCPMSS clamp to PMTU
ACCEPT     all  --  anywhere             anywhere           state
ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
TCPMSS     tcp  --  anywhere             anywhere           tcp
flags:SYN,RST/SYN TCPMSS clamp to PMTU
TCPMSS     tcp  --  anywhere             anywhere           tcp
flags:SYN,RST/SYN TCPMSS clamp to PMTU

Chain PREROUTING (0 references)
target     prot opt source               destination

Regards,



Ronald Roeleveld 
System Administrator 

ASCINTERNATIONAL 
Vlietweg 17c, 2266 KA, Leidschendam, The Netherlands 
Tel. +31 (0)70 3178400, Fax +31 (0)70 3204760
E-mail: r.roeleveld@ascinternational.nl
<mailto:r.roeleveld@ascinternational.nl> , Website:
http://www.ascinternational.nl <http://www.ascinternational.nl>  

 
 
 


-----Original Message-----
From: Eric Leblond [ mailto:eleblond@init-sys.com
<mailto:eleblond@init-sys.com> ]
Sent: dinsdag 4 februari 2003 11:49
To: ASC - Ronald Roeleveld
Subject: Re: Port forward


On Tue, 2003-02-04 at 11:31, ASC - Ronald Roeleveld wrote:
> Hi all,
> 
> Iam trying to set up a port forward for several hours now, but I don't
> seem to get it working right.
> When I type the following command:
> iptables -A PREROUTING -p tcp --destination-port 25 -i eth0 -j DNAT
> --to-destination 192.168.22.6:25

you forget to specify that you work on the NAT table so add
-t nat
ou your line

--
Éric Leblond
courriel : eleblond@init-sys.com



[-- Attachment #2: Type: text/html, Size: 6316 bytes --]

^ permalink raw reply	[flat|nested] 11+ messages in thread
* Messages to console
@ 2003-08-18 22:29 Len L.
  2003-08-19 10:58 ` André Valente
  0 siblings, 1 reply; 11+ messages in thread
From: Len L. @ 2003-08-18 22:29 UTC (permalink / raw)
  To: netfilter

[-- Attachment #1: Type: text/plain, Size: 403 bytes --]

Hey guys,
 
Not a killer, but I get all the iptable log messages to /dev/console.  I can not find where to control this.  I checked /etc/syslog.conf, but kernal messages was turned off (in fact if I turn kernal logging on I get duplicate messages to the console).  I also did man on iptables, but I do not see any reference to logging to /dev/console 
 
Can anyone point me in the right direction?

[-- Attachment #2: Type: text/html, Size: 654 bytes --]

^ permalink raw reply	[flat|nested] 11+ messages in thread
* RE: Port forward
@ 2003-02-04 13:43 ASC - Ronald Roeleveld
  0 siblings, 0 replies; 11+ messages in thread
From: ASC - Ronald Roeleveld @ 2003-02-04 13:43 UTC (permalink / raw)
  To: 'saint'; +Cc: 'netfilter@lists.netfilter.org'

Why I used telnet was just for testing. I wanted to test to make sure that
if I connected to port 25 with telnet to my firewall that it redirected me
to the mail server. And as it seems it doesn't work, because I get an error
that no connection can me estabslihed. And offcource for management purpose
I use SSH..:)


-----Original Message-----
From: saint [mailto:nagajuna@optushome.com.au]
Sent: dinsdag 4 februari 2003 14:31
To: ASC - Ronald Roeleveld; Netfilter Mailing List
Subject: RE: Port forward


I don't know what your setup is but I myself explicitly FORWARD
things to telnet:

e.g:

# Allow access to machines from the private LAN: 
iptables -A FORWARD -i INTERFACE_CONCERNED -o OUTPUT_INTERFACE -p tcp \
	 -s $LAN_MACHINES --sport $UN_PRIVILEGED_PORTS \
	 -d $DESTINATION_ADDRESS --dport 23 \
	 -m state --state NEW -j ACCEPT

you get the hint.

Any way why use telnet? I recommend secure shell (tcp port 22).

Santos.

Security is a blessing.
	 


^ permalink raw reply	[flat|nested] 11+ messages in thread
* RE: Port forward
@ 2003-02-04 13:20 Eugene Joubert
  0 siblings, 0 replies; 11+ messages in thread
From: Eugene Joubert @ 2003-02-04 13:20 UTC (permalink / raw)
  To: 'ASC - Ronald Roeleveld', Eugene Joubert
  Cc: 'netfilter@lists.netfilter.org'

[-- Attachment #1: Type: text/plain, Size: 2670 bytes --]

If you port forwarding happens from outside your linux box going inside your
network you should telnet from an external address to your linux ip on port
25. Also with every PREROUTING entry you would have to have an entry in your
FORWARD chain. This is if your FORWARD default policy is set to drop. If you
have the default policy on your FORWARD chain set to ACCEPT then you DON'T
have to specifically add it.
 
eg iptables -A FORWARD -p tcp -i eth0 -o eth1 -s 0/0 --dport 25 -j ACCEPT
 
Hope this helps
 
PS: Remeber you have to come in from outside your network to test this rule

-----Original Message-----
From: ASC - Ronald Roeleveld [mailto:r.roeleveld@ascinternational.nl] 
Sent: 04 02 2003 15:11 PM
To: 'Eugene Joubert'
Cc: 'netfilter@lists.netfilter.org'
Subject: RE: Port forward


Thanks a lot everyone for the emails...
I did iptables -t nat --list and it now gives me this output:
DNAT       tcp  --  anywhere             anywhere           tcp dpt:smtp
to:192.168.22.6:25
But when I tried to telnet from another machine to 192.168.22.5 port 25 (the
ip of the netfilter firewall/router) it didn't work at all..Do there has to
be a line somewhere that says it's allowed to forward these connections?
 
Regards,
 
Ronald.

-----Original Message-----
From: Eugene Joubert [mailto:eugenej@centratel.co.za]
Sent: dinsdag 4 februari 2003 11:41
To: 'ASC - Ronald Roeleveld';       
Subject: RE: Port forward


remember that you are using DNAT so you would have to specify the -t nat
switch in your line.
 
eg 
 
iptables -t nat -A PREROUTING -p tcp -s 0/0 --dport 25 -i eth0 -j DNAT --to
192.168.22.6:25
 
Hope this helps

-----Original Message-----
From: ASC - Ronald Roeleveld [mailto:r.roeleveld@ascinternational.nl] 
Sent: 04 02 2003 12:31 PM
To: 'netfilter@lists.netfilter.org'
Subject: Port forward


Hi all,
 
Iam trying to set up a port forward for several hours now, but I don't seem
to get it working right.
When I type the following command:
iptables -A PREROUTING -p tcp --destination-port 25 -i eth0 -j DNAT
--to-destination 192.168.22.6:25
I get this output:
iptables: Invalid argument
I did do iptables -X PREROUTING so the chain does exist.
Can anyone please help me out..
What I want is that all incoming connections on eth0 on port 25 are routed
to another machine on the internal network 192.168.22.6
 
Thanks in advance,
Ronald Roeleveld 
System Administrator 

ASCINTERNATIONAL 
Vlietweg 17c, 2266 KA, Leidschendam, The Netherlands 
Tel. +31 (0)70 3178400, Fax +31 (0)70 3204760
E-mail: r.roeleveld@ascinternational.nl
<mailto:r.roeleveld@ascinternational.nl> , Website:
http://www.ascinternational.nl <http://www.ascinternational.nl/>  

 


[-- Attachment #2: Type: text/html, Size: 7880 bytes --]

^ permalink raw reply	[flat|nested] 11+ messages in thread
* RE: Port forward
@ 2003-02-04 13:11 ASC - Ronald Roeleveld
  2003-02-04 13:28 ` Patrick Maartense
  2003-02-04 13:31 ` saint
  0 siblings, 2 replies; 11+ messages in thread
From: ASC - Ronald Roeleveld @ 2003-02-04 13:11 UTC (permalink / raw)
  To: 'Eugene Joubert'; +Cc: 'netfilter@lists.netfilter.org'

[-- Attachment #1: Type: text/plain, Size: 1877 bytes --]

Thanks a lot everyone for the emails...
I did iptables -t nat --list and it now gives me this output:
DNAT       tcp  --  anywhere             anywhere           tcp dpt:smtp
to:192.168.22.6:25
But when I tried to telnet from another machine to 192.168.22.5 port 25 (the
ip of the netfilter firewall/router) it didn't work at all..Do there has to
be a line somewhere that says it's allowed to forward these connections?
 
Regards,
 
Ronald.

-----Original Message-----
From: Eugene Joubert [mailto:eugenej@centratel.co.za]
Sent: dinsdag 4 februari 2003 11:41
To: 'ASC - Ronald Roeleveld';       
Subject: RE: Port forward


remember that you are using DNAT so you would have to specify the -t nat
switch in your line.
 
eg 
 
iptables -t nat -A PREROUTING -p tcp -s 0/0 --dport 25 -i eth0 -j DNAT --to
192.168.22.6:25
 
Hope this helps

-----Original Message-----
From: ASC - Ronald Roeleveld [mailto:r.roeleveld@ascinternational.nl] 
Sent: 04 02 2003 12:31 PM
To: 'netfilter@lists.netfilter.org'
Subject: Port forward


Hi all,
 
Iam trying to set up a port forward for several hours now, but I don't seem
to get it working right.
When I type the following command:
iptables -A PREROUTING -p tcp --destination-port 25 -i eth0 -j DNAT
--to-destination 192.168.22.6:25
I get this output:
iptables: Invalid argument
I did do iptables -X PREROUTING so the chain does exist.
Can anyone please help me out..
What I want is that all incoming connections on eth0 on port 25 are routed
to another machine on the internal network 192.168.22.6
 
Thanks in advance,
Ronald Roeleveld 
System Administrator 

ASCINTERNATIONAL 
Vlietweg 17c, 2266 KA, Leidschendam, The Netherlands 
Tel. +31 (0)70 3178400, Fax +31 (0)70 3204760
E-mail: r.roeleveld@ascinternational.nl
<mailto:r.roeleveld@ascinternational.nl> , Website:
http://www.ascinternational.nl <http://www.ascinternational.nl/>  

 


[-- Attachment #2: Type: text/html, Size: 5956 bytes --]

^ permalink raw reply	[flat|nested] 11+ messages in thread
* RE: Port forward
@ 2003-02-04 10:41 Eugene Joubert
  0 siblings, 0 replies; 11+ messages in thread
From: Eugene Joubert @ 2003-02-04 10:41 UTC (permalink / raw)
  To: 'ASC - Ronald Roeleveld',
	'netfilter@lists.netfilter.org'

[-- Attachment #1: Type: text/plain, Size: 1253 bytes --]

remember that you are using DNAT so you would have to specify the -t nat
switch in your line.
 
eg 
 
iptables -t nat -A PREROUTING -p tcp -s 0/0 --dport 25 -i eth0 -j DNAT --to
192.168.22.6:25
 
Hope this helps

-----Original Message-----
From: ASC - Ronald Roeleveld [mailto:r.roeleveld@ascinternational.nl] 
Sent: 04 02 2003 12:31 PM
To: 'netfilter@lists.netfilter.org'
Subject: Port forward


Hi all,
 
Iam trying to set up a port forward for several hours now, but I don't seem
to get it working right.
When I type the following command:
iptables -A PREROUTING -p tcp --destination-port 25 -i eth0 -j DNAT
--to-destination 192.168.22.6:25
I get this output:
iptables: Invalid argument
I did do iptables -X PREROUTING so the chain does exist.
Can anyone please help me out..
What I want is that all incoming connections on eth0 on port 25 are routed
to another machine on the internal network 192.168.22.6
 
Thanks in advance,
Ronald Roeleveld 
System Administrator 

ASCINTERNATIONAL 
Vlietweg 17c, 2266 KA, Leidschendam, The Netherlands 
Tel. +31 (0)70 3178400, Fax +31 (0)70 3204760
E-mail: r.roeleveld@ascinternational.nl
<mailto:r.roeleveld@ascinternational.nl> , Website:
http://www.ascinternational.nl <http://www.ascinternational.nl/>  

 


[-- Attachment #2: Type: text/html, Size: 3942 bytes --]

^ permalink raw reply	[flat|nested] 11+ messages in thread
* Port forward
@ 2003-02-04 10:31 ASC - Ronald Roeleveld
  0 siblings, 0 replies; 11+ messages in thread
From: ASC - Ronald Roeleveld @ 2003-02-04 10:31 UTC (permalink / raw)
  To: 'netfilter@lists.netfilter.org'

[-- Attachment #1: Type: text/plain, Size: 855 bytes --]

Hi all,
 
Iam trying to set up a port forward for several hours now, but I don't seem
to get it working right.
When I type the following command:
iptables -A PREROUTING -p tcp --destination-port 25 -i eth0 -j DNAT
--to-destination 192.168.22.6:25
I get this output:
iptables: Invalid argument
I did do iptables -X PREROUTING so the chain does exist.
Can anyone please help me out..
What I want is that all incoming connections on eth0 on port 25 are routed
to another machine on the internal network 192.168.22.6
 
Thanks in advance,
Ronald Roeleveld 
System Administrator 

ASCINTERNATIONAL 
Vlietweg 17c, 2266 KA, Leidschendam, The Netherlands 
Tel. +31 (0)70 3178400, Fax +31 (0)70 3204760
E-mail: r.roeleveld@ascinternational.nl
<mailto:r.roeleveld@ascinternational.nl> , Website:
http://www.ascinternational.nl <http://www.ascinternational.nl/>  

 

[-- Attachment #2: Type: text/html, Size: 2524 bytes --]

^ permalink raw reply	[flat|nested] 11+ messages in thread
end of thread, other threads:[~2003-08-21 13:38 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-02-04 10:56 Port forward ASC - Ronald Roeleveld
2003-02-04 11:17 ` RE : " Franck
2003-02-04 11:53 ` Sven Schuster
  -- strict thread matches above, loose matches on Subject: below --
2003-08-18 22:29 Messages to console Len L.
2003-08-19 10:58 ` André Valente
2003-08-21 13:38   ` Port forward Rimas
2003-02-04 13:43 ASC - Ronald Roeleveld
2003-02-04 13:20 Eugene Joubert
2003-02-04 13:11 ASC - Ronald Roeleveld
2003-02-04 13:28 ` Patrick Maartense
2003-02-04 13:31 ` saint
2003-02-04 10:41 Eugene Joubert
2003-02-04 10:31 ASC - Ronald Roeleveld

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox