> Hi all,
>
> I like to do the portforwarding with iptables(forward web traffic of an
> alias IP - <ext ip> to internal web server). Here is what I have:
>
> iptables -t nat -A PREROUTING -i eth0 -d <ext ip> -p tcp --dport 80 -j
> DNAT --to 10.1.0.12:80
ok
> iptables -A INPUT -p tcp -i eth0 -d <ext ip> --dport 80 -m state
> --state NEW -j ACCEPT
um--nope. the packets are going to be FORWARD-ed--they will never be seen by the INPUT chain.
> iptables -A FORWARD -p tcp -i eth0 -o eth1 -d <ext ip> --dport 80 -m
> state --state NEW -j ACCEPT
hmm...let's hold off on this for a sec...
> However, it keep droping the packets when getting to the NAT box.
>
> Logs
> ====
> (With iptables -A FORWARD -d 10.1.0.12 -j LOG; iptable -A FORWARD -j DROP)
>
> kernel: IN=eth0 OUT=eth1 SRC=202.xxx.122.xxx DST=10.1.0.12 LEN=48
> TOS=0x00 PREC=0x00 TTL=120 ID=6491 DF PROTO=TCP SPT=4023 DPT=80
> WINDOW=64240 RES=0x00 SYN URGP=0
>
> Any clues? Did I miss something here?
yeah--read that log entry. now look at your FORWARD rule. now read that log entry again. got it?
no? ok... look at the "-d <ext ip>" in the rule and the "DST=10.1.0.12" in the log entry.
DNAT happens in PREROUTING; as in, "before routing"--so any FORWARD rules will see the DNAT-ed address, not the original dest IP. try:
iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 10.1.0.12 \
--dport 80 -m state --state NEW -j ACCEPT
hopefully you also something along the lines of this somewhere as well:
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-j
