Re: Failing to get forwarding to work fully.

[David at roamware <david@roamware.co.uk>]

Rob Sterenborg wrote:
>> I have tried to get this iptables script on my Centos 4.4 machine
>> working, with some help, but still have not succeeded in forwarding
>> port 722 to a machine on the LAN attached to the machine running
>> iptables attached to the internet. The logging of the FORWARD
>> packets just before drop tells me they are being forwarded. I also
>> made sure the the LAN attached machine on eth0 does accept ssh -D
>> 722 once I logged into the public facing machine via ssh. So I kinda
>> assume it is the return packet that is the problem, but cannot see
>> why. Ideas? 333.333.333.333 is substituted for the public IP addr,
>> 111.111.111.111 222.222.222.222 are machines I want to be the only
>> ones that can access. eth0 is the LAN NIC and eth1 is the public
>> facing NIC.
>>
>> # Generated by iptables-save v1.2.11 on Thu Dec 15 17:00:25 2005
>> *filter
>>     
>
> [...]
>
>   
>> -A FORWARD -j LOG --log-level debug
>> -A FORWARD -d 192.168.0.0/255.255.255.0 -i eth1 -o eth0 \
>>     -p tcp -m multiport --dports 22,3306 -m state --state NEW \
>>     -j ACCEPT
>>     
>
> So NEW packets forwarded to port 22 will be allowed.
>
>   
>> -A FORWARD -i eth1 -o eth0 -m state \
>>     --state RELATED,ESTABLISHED -j ACCEPT
>>     
>
> Here you are only accepting packets from eth1 -> eth0 in a RELATED or
> ESTABLISHED connection. What about the return packets that will go from
> eth0 -> eth1? I really don't think you can setup a connection this way.
> Try:
>
> -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
>   

Tried this, it made no difference. I broadened the ports on the NEW to 
cover 722, so there was no confusion to the port 22 used to connect to 
the machine with the public facing NIC. Do I need a postrouting rule for 
the FORWARD used for the return packets?

David
>
> Grts,
> Rob
>
>
> -
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>