Re: Port Forwarding Problem

[Tom Smith <tom@xxxxxxxxxxxxxxxxxx>]

Found the problem...the GATEWAY on 20.246 was set to a different router
and not the firewall.

It started working after I changed it--thanks for your help!!!

Willi Dyck wrote:
> On Tue, Feb 25, 2003 at 11:06:55AM -0700, Tom Smith wrote:
> > Having problem forwarding 216.161.174.4 port 8241 to 192.168.20.246 port 22.
> >
> > I added the following rule to run DNAT:
> > $IPTABLES -t nat -A PREROUTING -p tcp -d 216.161.174.4 --dport 8241 -j 
> > DNAT --to-destination 192.168.20.246:22
> >   
>
> Good.
>
> > What I saw when trying to connect to the port from a remote host was:
> > uccinet kernel: IN=eth1 OUT=eth0 SRC="" DST=192.168.20.246 
> > LEN=60 TOS=0x10 PREC=0x00 TTL=45 ID=63685 DF PROTO=TCP SPT=2030 DPT=22 
> > WINDOW=5840 RES=0x00 SYN URGP=0
> >
> > I later learned that I also needed some FORWARD rules to make it work. 
> > The default script had most of them. I added:
> > $IPTABLES -A FORWARD -d 192.168.20.246 -p tcp --dport 22 -j ACCEPT
> >   
>
> Better. Much better would be a second rule which allows the way back
> from 192.168.20.246.
>
> $IPTABLES -A FORWARD -s 192.168.20.246 -p tcp --sport 22 -j ACCEPT
>
> What I see in your 'iptables -nL' output is that you allow everything
> in the FORWARD chain which has a state ESTABLISHED and/or RELATED, thus
> the second rule above isn't necessery. Does 192.168.20.246 have routing
> entry back to the inet? Also, what is the output of 'iptables -nvL
> FORWARD'?
>
> > Chain FORWARD (policy DROP)
> > target     prot opt source               destination         
> > ACCEPT     tcp  --  0.0.0.0/0            192.168.20.246     tcp dpt:22 
> > ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED 
> > ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0          
> > drop-and-log-it  all  --  0.0.0.0/0            0.0.0.0/0          
> >   
>
> Regards -- Willi