Re: IP Forwarding works on local port but not a remote port

[Dan Daugherty <rescue@ddaniscool.com>]

Well, I ended up figuring it out.  I swear I tried this early on
because this is how I wanted it to work in the first place.

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp --dport 1524 -i eth0 -j DNAT --to
10.117.1.203:1524

That is all I needed.  The machine sits behind another firewall so
none of the other chains are necessary.  Thanks for all the help.

Dan

On Fri, Feb 5, 2010 at 3:04 PM, Dan Daugherty <rescue@ddaniscool.com> wrote:
> Forgot to mention I'm on a Redhat Enterprise Linux 5 box with the
> stock kernel.  Tried to compile my own and the build fails
> immediately.  I assumed that since I can route requests locally, the
> kernel was compiled properly for iptables.
>
> On Fri, Feb 5, 2010 at 3:01 PM, Dan Daugherty <rescue@ddaniscool.com> wrote:
>>> Are you using /16 netmask?
>> No, I just took the 10.117 part off the ip's to shorten the message.
>>>
>>>
>>> None of them got SNATed. Why? Should they go out through eth0? Try to
>>> remove "-o eth0".
>> Removed it and no change
>>>
>>> Also do you have ip.forwarding enabled (sysctl -a | grep forward")?
>> net.ipv6.conf.eth0.forwarding = 0
>> net.ipv6.conf.default.forwarding = 0
>> net.ipv6.conf.all.forwarding = 0
>> net.ipv6.conf.lo.forwarding = 0
>> net.ipv4.conf.eth0.mc_forwarding = 0
>> net.ipv4.conf.eth0.forwarding = 1
>> net.ipv4.conf.lo.mc_forwarding = 0
>> net.ipv4.conf.lo.forwarding = 1
>> net.ipv4.conf.default.mc_forwarding = 0
>> net.ipv4.conf.default.forwarding = 1
>> net.ipv4.conf.all.mc_forwarding = 0
>> net.ipv4.conf.all.forwarding = 1
>>
>>>
>>> Can you reach 10.117.1.205:1521 from sethra (telnet 10.117.1.205 1521)?
>>>
>> Negative, but the command from sethra fails immediately with nothing
>> showing in the logs
>>
>> There has also been mention of a FORWARD chain being necessary.  I
>> haven't done anything outside of the commands listed in this thread.
>>
>