On Tue, Feb 25, 2003 at 11:06:55AM -0700, Tom Smith wrote: > Having problem forwarding 216.161.174.4 port 8241 to 192.168.20.246 port 22. > > I added the following rule to run DNAT: > $IPTABLES -t nat -A PREROUTING -p tcp -d 216.161.174.4 --dport 8241 -j > DNAT --to-destination 192.168.20.246:22 Good. > What I saw when trying to connect to the port from a remote host was: > uccinet kernel: IN=eth1 OUT=eth0 SRC=64.158.129.226 DST=192.168.20.246 > LEN=60 TOS=0x10 PREC=0x00 TTL=45 ID=63685 DF PROTO=TCP SPT=2030 DPT=22 > WINDOW=5840 RES=0x00 SYN URGP=0 > > I later learned that I also needed some FORWARD rules to make it work. > The default script had most of them. I added: > $IPTABLES -A FORWARD -d 192.168.20.246 -p tcp --dport 22 -j ACCEPT Better. Much better would be a second rule which allows the way back from 192.168.20.246. $IPTABLES -A FORWARD -s 192.168.20.246 -p tcp --sport 22 -j ACCEPT What I see in your 'iptables -nL' output is that you allow everything in the FORWARD chain which has a state ESTABLISHED and/or RELATED, thus the second rule above isn't necessery. Does 192.168.20.246 have routing entry back to the inet? Also, what is the output of 'iptables -nvL FORWARD'? > Chain FORWARD (policy DROP) > target prot opt source destination > ACCEPT tcp -- 0.0.0.0/0 192.168.20.246 tcp dpt:22 > ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED > ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 > drop-and-log-it all -- 0.0.0.0/0 0.0.0.0/0 Regards -- Willi -- -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GPA/CS dx s-:- a-- C++$ UL/S+++>++++ P++>+++ L+++(++++)$ !E W+ N- o? K? !w 0? !M V- PS++(---) !PE Y+ PGP++ t-- !5 X+ R- !tv b+(++) DI++ D+++ G e+ h-- r y? ------END GEEK CODE BLOCK------
