Port forward/bounce no external interface

Port forward/bounce no external interface

[Don Hoover]

I want to forward all connections on a port to another box on the same internal network.

For instance, I want to forward all traffic on my server:5000 to go anotherbox:9000

I have little experience with iptables, and I am currently not using it at all on this server, so I will need to setup a small iptables configuration from scratch including any required setup before whatever command is needed to do this.

This will all be in the same network and not actually be going across interfaces...the client, server, and otherbox are all located on the same internal network.

I am sure this is probably easy for someone what really knows what they are doing.... AND...I have been reading as much as I can on this, and all the examples I have found via extensive google searching all deal with the apparently much more common case of forwarding incoming connections on a external facing network interface to a different port for a different IP on an internal facing interface, ala firewall router.  And that just does not apply here.  I kinda thought maybe what I wanted was a variation on that and I tried some different things but none of them worked.

Any help?

Re: Port forward/bounce no external interface

[Mart Frauenlob]

Don Hoover wrote:
> I want to forward all connections on a port to another box on the same internal network.
>
> For instance, I want to forward all traffic on my server:5000 to go anotherbox:9000
>
> I have little experience with iptables, and I am currently not using it at all on this server, so I will need to setup a small iptables configuration from scratch including any required setup before whatever command is needed to do this.
>
> This will all be in the same network and not actually be going across interfaces...the client, server, and otherbox are all located on the same internal network.
>
> I am sure this is probably easy for someone what really knows what they are doing.... AND...I have been reading as much as I can on this, and all the examples I have found via extensive google searching all deal with the apparently much more common case of forwarding incoming connections on a external facing network interface to a different port for a different IP on an internal facing interface, ala firewall router.  And that just does not apply here.  I kinda thought maybe what I wanted was a variation on that and I tried some different things but none of them worked.
>
> Any help?
>   
Hello,

Please try:

iptables -t nat -A PREROUTING -s your-network -d server -p tcp --dport 
-j DNAT --to-destination anotherbox:9000

this should do the forwarding.

now, that your other box does not talk to the original client (as this 
probably wont work), change the source address to the one of your server:

iptables -t nat -A POSTROUTING -d anotherbox -p tcp --dport 9000 -j SNAT 
--to-source server

keep the policy in all chains to ACCEPT as long you test.

after you get it working, get as restrictive as you like.
do not forget to allow the traffic in the FORWARD chain:

iptables -A FORWARD -i iface -o iface -d anotherbox -p tcp --dport 9000 
-j ACCEPT


this should be a good reference for creating your ruleset:
http://iptables-tutorial.frozentux.net/iptables-tutorial.html


greets

mart

Re: Port forward/bounce no external interface

[Mart Frauenlob]

Mart Frauenlob wrote:
> Don Hoover wrote:
>> I want to forward all connections on a port to another box on the 
>> same internal network.
>>
>> For instance, I want to forward all traffic on my server:5000 to go 
>> anotherbox:9000
>>
>> I have little experience with iptables, and I am currently not using 
>> it at all on this server, so I will need to setup a small iptables 
>> configuration from scratch including any required setup before 
>> whatever command is needed to do this.
>>
>> This will all be in the same network and not actually be going across 
>> interfaces...the client, server, and otherbox are all located on the 
>> same internal network.
>>
>> I am sure this is probably easy for someone what really knows what 
>> they are doing.... AND...I have been reading as much as I can on 
>> this, and all the examples I have found via extensive google 
>> searching all deal with the apparently much more common case of 
>> forwarding incoming connections on a external facing network 
>> interface to a different port for a different IP on an internal 
>> facing interface, ala firewall router.  And that just does not apply 
>> here.  I kinda thought maybe what I wanted was a variation on that 
>> and I tried some different things but none of them worked.
>>
>> Any help?
>>   
> Hello,
>
> Please try:
>
> iptables -t nat -A PREROUTING -s your-network -d server -p tcp --dport 
> -j DNAT --to-destination anotherbox:9000

sorry, I missed the port string.
should be:

iptables -t nat -A PREROUTING -s your-network -d server -p tcp --dport 
5000 -j DNAT --to-destination anotherbox:9000

Re: Port forward/bounce no external interface

[Don Hoover]

Hey that worked.. Thanks.



---
Don Hoover
dxh@yahoo.com


--- On Fri, 2/6/09, Mart Frauenlob <mart.frauenlob@chello.at> wrote:

> From: Mart Frauenlob <mart.frauenlob@chello.at>
> Subject: Re: Port forward/bounce no external interface
> To: netfilter@vger.kernel.org
> Date: Friday, February 6, 2009, 4:15 PM
> Mart Frauenlob wrote:
> > Don Hoover wrote:
> >> I want to forward all connections on a port to
> another box on the same internal network.
> >> 
> >> For instance, I want to forward all traffic on my
> server:5000 to go anotherbox:9000
> >> 
> >> I have little experience with iptables, and I am
> currently not using it at all on this server, so I will need
> to setup a small iptables configuration from scratch
> including any required setup before whatever command is
> needed to do this.
> >> 
> >> This will all be in the same network and not
> actually be going across interfaces...the client, server,
> and otherbox are all located on the same internal network.
> >> 
> >> I am sure this is probably easy for someone what
> really knows what they are doing.... AND...I have been
> reading as much as I can on this, and all the examples I
> have found via extensive google searching all deal with the
> apparently much more common case of forwarding incoming
> connections on a external facing network interface to a
> different port for a different IP on an internal facing
> interface, ala firewall router.  And that just does not
> apply here.  I kinda thought maybe what I wanted was a
> variation on that and I tried some different things but none
> of them worked.
> >> 
> >> Any help?
> >>   
> > Hello,
> > 
> > Please try:
> > 
> > iptables -t nat -A PREROUTING -s your-network -d
> server -p tcp --dport -j DNAT --to-destination
> anotherbox:9000
> 
> sorry, I missed the port string.
> should be:
> 
> iptables -t nat -A PREROUTING -s your-network -d server -p
> tcp --dport 5000 -j DNAT --to-destination anotherbox:9000