Re: Port forwarding with iptables on tunnel interface

[Mike Wright <mike.wright@mailinator.com>]

Guido Trentalancia wrote:
> Hello again !
> 
> There are two things that look odd to me:
> 
> 1) packets on port 25 are correctly forwarded (after decapsulation) to
> the redirected host on the 192.168.3.0 network *but* nothing goes back
> on the same network on port 25 (i.e. from interface eth0 to tunl0);
> 2) there is a very strange and very long MAC entry in the PREROUTING log
> for IN=tunl0.
> 
> I have tried using the target TRACE, but it doesn't help much. I've got
> plenty of LOG targets disseminated everywhere that TRACE doesn't add
> anything. But again, I can't see POSTROUTING from the host where packets
> are being forwarded and I can't see replies going back on eth0 from that
> same machine (the sendmail machine) to the iptables machine.
> 
> I also forgot to attach the iptables rules in my previous message, but
> here you go:
> 
> *raw
> :PREROUTING ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> -A PREROUTING -p tcp --dport 25 -j TRACE
> -A PREROUTING -p tcp --dport 25 -j TRACE
> COMMIT
> *nat
> :PREROUTING ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> :POSTROUTING ACCEPT [0:0]
> -A PREROUTING -p tcp --dport 25 -j LOG --log-prefix "PREROUTING: "
> -A PREROUTING -p tcp --dport 25 -j DNAT --to-destination 192.168.3.69
> -A PREROUTING -p tcp --dport 587 -j DNAT --to-destination 192.168.3.69
> -A OUTPUT -p tcp --dport 25 -j LOG --log-prefix "OUTPUT: "
> -A OUTPUT -p tcp --dport 25 -j DNAT --to-destination 192.168.3.69
> # The following rule is not related, it's masquerading for another
> network...
> -A POSTROUTING -o eth0 -s 192.168.4.0/24 -j MASQUERADE
> -A POSTROUTING -p tcp --dport 25 -j LOG --log-prefix "POSTROUTING: "
> -A POSTROUTING -o eth0 -p tcp --dport 25 -j MASQUERADE
> -A POSTROUTING -o eth0 -p tcp --dport 587 -j MASQUERADE
> #-A POSTROUTING -o eth0 -p tcp --dport 25 -j SNAT --to-source
> 192.168.3.64
> #-A POSTROUTING -o eth0 -p tcp --dport 587 -j SNAT --to-source
> 192.168.3.64
> COMMIT

<snip />

Salve, Guido.  I gave this a verrrry quick glance and off the top of my 
head I think something looks fishy in the POSTROUTING rules.

In the PREROUTING you are selecting based on the *destination* port.  On 
the return trip shouldn't POSTROUTING use *source* port?

Hope that helps,
Mike Wright