From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Big Daddy" Subject: HTTP Port forwarding issues Date: Mon, 8 Jul 2002 15:37:38 -0400 Sender: netfilter-admin@lists.samba.org Message-ID: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_001C_01C22695.63CF5570" Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.samba.org This is a multi-part message in MIME format. ------=_NextPart_000_001C_01C22695.63CF5570 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable all, for some reason i can get my smtp and pop3 to route from the = internet, but i cannot get http requests to forward correctly. iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport http -m = state --state NEW -j ACCEPT iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport smtp -m = state --state NEW -j ACCEPT (works) iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport pop3 -m = state --state NEW -j ACCEPT (works) iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport smtp -j DNAT = --to-destination $int_smtp:25 (works) iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport pop3 -j DNAT = --to-destination $int_pop3:110 (works) iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport http -j DNAT = --to-destination $int_http:80 web server is running IIS5. any help would be great! Big D@ddy ------=_NextPart_000_001C_01C22695.63CF5570 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

all,
for some reason i can get my smtp = and pop3=20 to route from the internet, but i cannot get http requests to = forward=20 correctly.

iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport = http -m=20 state --state NEW -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 = -d=20 $int_ip -p tcp --dport smtp -m state --state NEW -j ACCEPT=20 (works)
iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp = --dport=20 pop3 -m state --state NEW -j ACCEPT (works)

iptables -t nat = -A=20 PREROUTING -d $ext_ip -p tcp --dport smtp -j DNAT --to-destination = $int_smtp:25=20 (works)
iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport = pop3 -j=20 DNAT --to-destination $int_pop3:110 (works)
iptables -t nat -A=20 PREROUTING -d $ext_ip -p tcp --dport http -j DNAT --to-destination=20 $int_http:80

web server is running IIS5.
any help would = be=20 great!
Big D@ddy

------=_NextPart_000_001C_01C22695.63CF5570-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tom Eastep Subject: Re: HTTP Port forwarding issues Date: Mon, 08 Jul 2002 12:44:19 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <3D29EB93.9080109@shorewall.net> References: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Big Daddy Cc: netfilter@lists.samba.org Big Daddy wrote: > all, > for some reason i can get my smtp and pop3 to route from > the internet, but i cannot get http requests to forward correctly. > > iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport http -m > state --state NEW -j ACCEPT > iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport smtp -m > state --state NEW -j ACCEPT (works) > iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport pop3 -m > state --state NEW -j ACCEPT (works) > > iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport smtp -j DNAT > --to-destination $int_smtp:25 (works) > iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport pop3 -j DNAT > --to-destination $int_pop3:110 (works) > iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport http -j DNAT > --to-destination $int_http:80 > > web server is running IIS5. > any help would be great! More than likely your ISP is blocking incoming HTTP requests. -Tom -- Tom Eastep \ Shorewall - iptables made easy AIM: tmeastep \ http://www.shorewall.net ICQ: #60745924 \ teastep@shorewall.net From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: HTTP Port forwarding issues Date: Mon, 8 Jul 2002 20:49:16 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <20020708194919.BSXL19225.mta07-svc.ntlworld.com@there> References: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Monday 08 July 2002 8:37 pm, Big Daddy wrote: > all, > for some reason i can get my smtp and pop3 to route from the > internet, but i cannot get http requests to forward correctly. Okay, so what's not working ? Are the incoming requests not getting to the server, or is the server trying to do some sort of reverse DNS lookup, or is the response not getting out again ? Put some LOGging rules onto your firewall to see what packets are or aren't flowing, or else just try iptables -L -n -v -x iptables -L -n -v -x -t nat and see what packets seem to be where. Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stewart Thompson Subject: RE: HTTP Port forwarding issues Date: Mon, 08 Jul 2002 12:50:19 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: References: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> Reply-To: stewart.thompson@shaw.ca Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="Boundary_(ID_Wk6mwNeEvenmBcu6h5cecg)" Return-path: In-Reply-To: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Big Daddy , netfilter@lists.samba.org This is a multi-part message in MIME format. --Boundary_(ID_Wk6mwNeEvenmBcu6h5cecg) Content-type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Try changing your NEW statement to NEW, ESTABLISHED, RELATED and see if that helps your situation. Stu=85=85 -----Original Message----- From: netfilter-admin@lists.samba.org [mailto:netfilter-admin@lists.samba.org]On Behalf Of Big Daddy Sent: July 8, 2002 12:38 PM To: netfilter@lists.samba.org Subject: HTTP Port forwarding issues all, for some reason i can get my smtp and pop3 to route from the internet, but i cannot get http requests to forward correctly. iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport http -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport smtp -m state --state NEW -j ACCEPT (works) iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport pop3 -m state --state NEW -j ACCEPT (works) iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport smtp -j DNAT --to-destination $int_smtp:25 (works) iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport pop3 -j DNAT --to-destination $int_pop3:110 (works) iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport http -j DNAT --to-destination $int_http:80 web server is running IIS5. any help would be great! Big D@ddy --Boundary_(ID_Wk6mwNeEvenmBcu6h5cecg) Content-type: text/html; charset=iso-8859-1 Content-transfer-encoding: 7BIT

Try changing your NEW statement to NEW, ESTABLISHED, RELATED and see if that helps your situation.

Stu……

-----Original Message-----
From: netfilter-admin@lists.samba.org [mailto:netfilter-admin@lists.samba.org]On Behalf Of Big Daddy
Sent: July 8, 2002 12:38 PM
To: netfilter@lists.samba.org
Subject: HTTP Port forwarding issues

all,
for some reason i can get my smtp and pop3 to route from the internet, but i cannot get http requests to forward correctly.

iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport http -m state --state NEW -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport smtp -m state --state NEW -j ACCEPT (works)
iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport pop3 -m state --state NEW -j ACCEPT (works)

iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport smtp -j DNAT --to-destination $int_smtp:25 (works)
iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport pop3 -j DNAT --to-destination $int_pop3:110 (works)
iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport http -j DNAT --to-destination $int_http:80

web server is running IIS5.
any help would be great!
Big D@ddy

--Boundary_(ID_Wk6mwNeEvenmBcu6h5cecg)-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Big Daddy" Subject: Re: HTTP Port forwarding issues Date: Mon, 8 Jul 2002 15:51:58 -0400 Sender: netfilter-admin@lists.samba.org Message-ID: <000d01c226b8$eb7b9ce0$6702a8c0@internal.monstersolutions.net> References: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> <3D29EB93.9080109@shorewall.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Tom Eastep Cc: netfilter@lists.samba.org It worked when I was using a Linksys router. However maybe they have changed it since then. Do my rules look fine? ----- Original Message ----- From: "Tom Eastep" To: "Big Daddy" Cc: Sent: Monday, July 08, 2002 3:44 PM Subject: Re: HTTP Port forwarding issues > Big Daddy wrote: > > all, > > for some reason i can get my smtp and pop3 to route from > > the internet, but i cannot get http requests to forward correctly. > > > > iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport http -m > > state --state NEW -j ACCEPT > > iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport smtp -m > > state --state NEW -j ACCEPT (works) > > iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport pop3 -m > > state --state NEW -j ACCEPT (works) > > > > iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport smtp -j DNAT > > --to-destination $int_smtp:25 (works) > > iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport pop3 -j DNAT > > --to-destination $int_pop3:110 (works) > > iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport http -j DNAT > > --to-destination $int_http:80 > > > > web server is running IIS5. > > any help would be great! > > More than likely your ISP is blocking incoming HTTP requests. > > -Tom > -- > Tom Eastep \ Shorewall - iptables made easy > AIM: tmeastep \ http://www.shorewall.net > ICQ: #60745924 \ teastep@shorewall.net > From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: HTTP Port forwarding issues Date: Mon, 8 Jul 2002 20:57:12 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <20020708195715.CBTA19225.mta07-svc.ntlworld.com@there> References: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> <3D29EB93.9080109@shorewall.net> <000d01c226b8$eb7b9ce0$6702a8c0@internal.monstersolutions.net> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <000d01c226b8$eb7b9ce0$6702a8c0@internal.monstersolutions.net> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Monday 08 July 2002 8:51 pm, Big Daddy wrote: > It worked when I was using a Linksys router. However maybe they have > changed it since then. Do my rules look fine? Well, I hope these are not your *only* rules ? I mean, like Stewart suggested, what about the ESTABLISHED packets as well as the NEW ones ? Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tom Eastep Subject: Re: HTTP Port forwarding issues Date: Mon, 08 Jul 2002 12:56:27 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <3D29EE6B.6030404@shorewall.net> References: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> <3D29EB93.9080109@shorewall.net> <000d01c226b8$eb7b9ce0$6702a8c0@internal.monstersolutions.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Big Daddy Cc: netfilter@lists.samba.org Big Daddy wrote: > It worked when I was using a Linksys router. However maybe they have changed > it since then. Do my rules look fine? > Yes, assuming that $int_http is set correctly and that you have a rule that passes --state ESTABLISHED packets in both directions through the FORWARD chain. -Tom -- Tom Eastep \ Shorewall - iptables made easy AIM: tmeastep \ http://www.shorewall.net ICQ: #60745924 \ teastep@shorewall.net From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Darrell Dieringer" Subject: RE: HTTP Port forwarding issues Date: Mon, 8 Jul 2002 15:00:11 -0500 Sender: netfilter-admin@lists.samba.org Message-ID: References: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Big Daddy , netfilter@lists.samba.org Hello, Have you confirmed that the packets are leaving the firewall / router (by using tcpdump, etc)? If they are, then it might be an IIS configuration issue. I had some trouble forwarding http connections to internal IIS machines (IIS4 on NT4 Server and IIS5 on Win2K Pro). After much head pounding, I found the solution to my problem. If I remember correctly... On the main property page for the web site in IIS, the "IP Address" field should be set to "All Unassigned" and the port must be set to the same one that is being forwarded. (ie, you must forward $ext_ip:8080 to $int_ip:8080). Though there's nothing about http that requires the ports to match, IIS has some trouble. For instance, if your arrangement is $ext_ip:8080 to $int_ip:80, IIS replies to the initial request for whatever page with an http redirect (302, I think). Actually, it may only do this if the "IP Address" field in the main propery page is set to something other than "All Unassigned". That redirect tells the client to ask for the page on a different port. If that port is blocked by your firewall or by your ISP (as it is in my case), the client never receives the content because the redirect was unsuccessful. It has been many months since I solved this problem for my own home setup, so I don't remember all the details. After confirming that the packets are indeed on the wire, examine both your firewall logs and your IIS logs for a clue to what's going on. I know I delved offtopic for netfilter, but hopefully it ends up being helpful to a couple of people. Darrell -----Original Message----- From: netfilter-admin@lists.samba.org [mailto:netfilter-admin@lists.samba.org]On Behalf Of Big Daddy Sent: Monday, July 08, 2002 2:38 PM To: netfilter@lists.samba.org Subject: HTTP Port forwarding issues all, for some reason i can get my smtp and pop3 to route from the internet, but i cannot get http requests to forward correctly. iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport http -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport smtp -m state --state NEW -j ACCEPT (works) iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport pop3 -m state --state NEW -j ACCEPT (works) iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport smtp -j DNAT --to-destination $int_smtp:25 (works) iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport pop3 -j DNAT --to-destination $int_pop3:110 (works) iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport http -j DNAT --to-destination $int_http:80 web server is running IIS5. any help would be great! Big D@ddy From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Big Daddy" Subject: Re: HTTP Port forwarding issues Date: Mon, 8 Jul 2002 16:03:50 -0400 Sender: netfilter-admin@lists.samba.org Message-ID: <003501c226ba$93cc7da0$6702a8c0@internal.monstersolutions.net> References: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> <3D29EB93.9080109@shorewall.net> <000d01c226b8$eb7b9ce0$6702a8c0@internal.monstersolutions.net> <20020708195715.CBTA19225.mta07-svc.ntlworld.com@there> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Antony Stone , netfilter@lists.samba.org i have the following rule as well. iptables -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT ----- Original Message ----- From: "Antony Stone" To: Sent: Monday, July 08, 2002 3:57 PM Subject: Re: HTTP Port forwarding issues > On Monday 08 July 2002 8:51 pm, Big Daddy wrote: > > > It worked when I was using a Linksys router. However maybe they have > > changed it since then. Do my rules look fine? > > Well, I hope these are not your *only* rules ? I mean, like Stewart > suggested, what about the ESTABLISHED packets as well as the NEW ones ? > > > > Antony. > From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: HTTP Port forwarding issues Date: Mon, 8 Jul 2002 21:07:35 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <20020708200737.CDNC4119.mta06-svc.ntlworld.com@there> References: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> <20020708195715.CBTA19225.mta07-svc.ntlworld.com@there> <003501c226ba$93cc7da0$6702a8c0@internal.monstersolutions.net> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <003501c226ba$93cc7da0$6702a8c0@internal.monstersolutions.net> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Monday 08 July 2002 9:03 pm, Big Daddy wrote: > i have the following rule as well. > > iptables -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT Okay, what about a rule allowing the reply packets back out of eth0 ? Antony > ----- Original Message ----- > From: "Antony Stone" > To: > Sent: Monday, July 08, 2002 3:57 PM > Subject: Re: HTTP Port forwarding issues > > > On Monday 08 July 2002 8:51 pm, Big Daddy wrote: > > > It worked when I was using a Linksys router. However maybe they have > > > changed it since then. Do my rules look fine? > > > > Well, I hope these are not your *only* rules ? I mean, like Stewart > > suggested, what about the ESTABLISHED packets as well as the NEW ones ? > > > > > > > > Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stewart Thompson Subject: RE: HTTP Port forwarding issues Date: Mon, 08 Jul 2002 13:11:33 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: References: <003501c226ba$93cc7da0$6702a8c0@internal.monstersolutions.net> Reply-To: stewart.thompson@shaw.ca Mime-Version: 1.0 Content-Transfer-Encoding: 7BIT Return-path: In-Reply-To: <003501c226ba$93cc7da0$6702a8c0@internal.monstersolutions.net> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Big Daddy , Antony Stone , netfilter@lists.samba.org Perhaps you should publish your entire rule set. Trying to help you with piecemeal rules is pretty tough. The order of the rules is important. Logging is also useful as recommended in an earlier post. What does a TCPDUMP show for port 80 on the External and Internal Interfaces. Also, what are you using to test your port 80? Internal machines will act very different than machines coming in from the Internet. Stu........ -----Original Message----- From: netfilter-admin@lists.samba.org [mailto:netfilter-admin@lists.samba.org]On Behalf Of Big Daddy Sent: July 8, 2002 1:04 PM To: Antony Stone; netfilter@lists.samba.org Subject: Re: HTTP Port forwarding issues i have the following rule as well. iptables -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT ----- Original Message ----- From: "Antony Stone" To: Sent: Monday, July 08, 2002 3:57 PM Subject: Re: HTTP Port forwarding issues > On Monday 08 July 2002 8:51 pm, Big Daddy wrote: > > > It worked when I was using a Linksys router. However maybe they have > > changed it since then. Do my rules look fine? > > Well, I hope these are not your *only* rules ? I mean, like Stewart > suggested, what about the ESTABLISHED packets as well as the NEW ones ? > > > > Antony. > From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Nathan Cassano" Subject: RE: HTTP Port forwarding issues Date: Mon, 8 Jul 2002 13:25:47 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <40c701c226bd$a51c87a0$2901a8c0@amos> References: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <001f01c226b6$eb0a4f60$6702a8c0@internal.monstersolutions.net> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org Remember HTTP runs over UDP protocol also. So for every HTTP TCP rule add a UDP copy ( -p udp ). > iptables -A FORWARD -p tcp -i eth0 -d $int_ip -p tcp --dport http -m state --state NEW -j ACCEPT > > iptables -t nat -A PREROUTING -d $ext_ip -p tcp --dport http -j DNAT --to-destination $int_http:80 From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Big Daddy" Subject: Re: HTTP Port forwarding issues Date: Mon, 8 Jul 2002 16:39:16 -0400 Sender: netfilter-admin@lists.samba.org Message-ID: <001501c226bf$875467e0$6702a8c0@internal.monstersolutions.net> References: Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: stewart.thompson@shaw.ca, Antony Stone , netfilter@lists.samba.org all, I guess my ISP is blocking port 80. I configured the web server to use port 8080 and configured my rules the same as before but used port 8080 and it worked. thanks for all of the help! ----- Original Message ----- From: "Stewart Thompson" To: "Big Daddy" ; "Antony Stone" ; Sent: Monday, July 08, 2002 4:11 PM Subject: RE: HTTP Port forwarding issues > Perhaps you should publish your entire rule set. Trying to help you with > piecemeal rules is pretty tough. > The order of the rules is important. Logging is also useful as recommended > in an earlier post. What does > a TCPDUMP show for port 80 on the External and Internal Interfaces. Also, > what are you using to test > your port 80? Internal machines will act very different than machines coming > in from the Internet. > > Stu........ > > > -----Original Message----- > From: netfilter-admin@lists.samba.org > [mailto:netfilter-admin@lists.samba.org]On Behalf Of Big Daddy > Sent: July 8, 2002 1:04 PM > To: Antony Stone; netfilter@lists.samba.org > Subject: Re: HTTP Port forwarding issues > > i have the following rule as well. > > iptables -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT > > ----- Original Message ----- > From: "Antony Stone" > To: > Sent: Monday, July 08, 2002 3:57 PM > Subject: Re: HTTP Port forwarding issues > > > > On Monday 08 July 2002 8:51 pm, Big Daddy wrote: > > > > > It worked when I was using a Linksys router. However maybe they have > > > changed it since then. Do my rules look fine? > > > > Well, I hope these are not your *only* rules ? I mean, like Stewart > > suggested, what about the ESTABLISHED packets as well as the NEW ones ? > > > > > > > > Antony. > > > > > From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: HTTP Port forwarding issues Date: Mon, 8 Jul 2002 21:42:46 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <20020708204248.DTQF4119.mta06-svc.ntlworld.com@there> References: <001501c226bf$875467e0$6702a8c0@internal.monstersolutions.net> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <001501c226bf$875467e0$6702a8c0@internal.monstersolutions.net> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Monday 08 July 2002 9:39 pm, Big Daddy wrote: > all, > I guess my ISP is blocking port 80. I configured the web server to use > port 8080 and configured my rules the same as before but used port 8080 and > it worked. thanks for all of the help! Round of applause to Tom Eastep, I think :-) Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: HTTP Port forwarding issues Date: Mon, 8 Jul 2002 21:50:28 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <20020708205030.ECXA4119.mta06-svc.ntlworld.com@there> References: <40c701c226bd$a51c87a0$2901a8c0@amos> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <40c701c226bd$a51c87a0$2901a8c0@amos> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Monday 08 July 2002 9:25 pm, Nathan Cassano wrote: > Remember HTTP runs over UDP protocol also. WHAT ????? RFC # ? Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Adam D. Barratt" Subject: Re: HTTP Port forwarding issues Date: Mon, 8 Jul 2002 22:20:23 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <086201c226c5$4567f990$3200a8c0@jungle.funkybadger.org> References: <40c701c226bd$a51c87a0$2901a8c0@amos> <20020708205030.ECXA4119.mta06-svc.ntlworld.com@there> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org Antony Stone wrote: > On Monday 08 July 2002 9:25 pm, Nathan Cassano wrote: > > > Remember HTTP runs over UDP protocol also. > > WHAT ????? > > RFC # ? I'd disagree with that statement as well, but as a side note HTTP is not limited to TCP. RFC2616 (HTTP/1.1) says: 1.4 Overall Operation [...] HTTP communication usually takes place over TCP/IP connections. The default port is TCP 80 [19], but other ports can be used. This does not preclude HTTP from being implemented on top of any other protocol on the Internet, or on other networks. HTTP only presumes a reliable transport; any protocol that provides such guarantees can be used; [...] 19.6.3 Changes from RFC 2068 [...] 4. Modified some TCP-specific language, to make it clearer that non-TCP transports are possible for HTTP. UDP, however, doesn't fit the definition of "reliable transport", IMO. Adam From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Nathan Cassano" Subject: RE: HTTP Port forwarding issues Date: Mon, 8 Jul 2002 14:35:00 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <40fb01c226c7$5014e810$2901a8c0@amos> References: <20020708205030.ECXA4119.mta06-svc.ntlworld.com@there> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20020708205030.ECXA4119.mta06-svc.ntlworld.com@there> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: 'Antony Stone' , netfilter@lists.samba.org Hmm... After a little research it appears that I am wrong. Darn, I hate looking like a fool. Sorry for the misinformation. RFC 2616: Hypertext Transfer Protocol -- HTTP/1.1 ftp://ftp.isi.edu/in-notes/rfc2616.txt Antony Stone wrote: >> Remember HTTP runs over UDP protocol also. > >WHAT ????? > >RFC # ? > > > >Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jan Humme Subject: Re: HTTP Port forwarding issues Date: Tue, 9 Jul 2002 11:52:39 +0200 Sender: netfilter-admin@lists.samba.org Message-ID: <02070911523900.05759@Lms> References: <40fb01c226c7$5014e810$2901a8c0@amos> Reply-To: jan.humme@xs4all.nl Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <40fb01c226c7$5014e810$2901a8c0@amos> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Nathan Cassano , 'Antony Stone' , netfilter@lists.samba.org Of course, HTTP runs over TCP, but who can explain why in /etc/services: # grep http /etc/services # http://www.isi.edu/in-notes/iana/assignments/port-numbers http 80/tcp www www-http # WorldWideWeb HTTP http 80/udp www www-http # HyperText Transfer Protocol https 443/tcp # MCom https 443/udp # MCom gss-http 488/tcp gss-http 488/udp http-alt 8008/tcp http-alt 8008/udp Ports and port numbers are different for TCP and UDP, right? Jan Humme. On Monday 08 July 2002 23:35, Nathan Cassano wrote: > Hmm... After a little research it appears that I am wrong. Darn, I hate > looking like a fool. Sorry for the misinformation. > > RFC 2616: Hypertext Transfer Protocol -- HTTP/1.1 > ftp://ftp.isi.edu/in-notes/rfc2616.txt > > Antony Stone wrote: > >> Remember HTTP runs over UDP protocol also. > > > >WHAT ????? > > > >RFC # ? > > > > > > > >Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Sneeringer Subject: tcp/udp ports (was: Re: HTTP Port forwarding issues) Date: Tue, 9 Jul 2002 09:15:22 -0500 Sender: netfilter-admin@lists.samba.org Message-ID: <20020709141522.GA798@valjean.si.ocslink.com> References: <40fb01c226c7$5014e810$2901a8c0@amos> <02070911523900.05759@Lms> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <02070911523900.05759@Lms> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@lists.samba.org On Tue, Jul 09, 2002 at 11:52:39AM +0200, Jan Humme wrote: | Of course, HTTP runs over TCP, but who can explain why in /etc/services: | http 80/tcp www www-http # WorldWideWeb HTTP | http 80/udp www www-http # HyperText Transfer Protocol The IANA frequently allocates the same port for both protocols. Take a look at RFC 1700. You'll see that most services have both TCP and UDP ports reserved, even though most probably use only one of them. | Ports and port numbers are different for TCP and UDP, right? Correct. Look at ports 512, 513, and 514 in /etc/services. -James