Nick Drage wrote:
On Thu, Aug 19, 2004 at 06:57:59PM +0800, Wilson Mak wrote:Thanks for all who help on this issue. I mis-type the rule here. Yes you guys are right, the rule should be: -d 10.1.0.12. But still it doesn't work. Do I need to enable something in the kernel when using Port-Forwarding?
Hi all,
I like to do the portforwarding with iptables(forward web traffic of an alias IP - <ext ip> to internal web server). Here is what I have:
iptables -t nat -A PREROUTING -i eth0 -d <ext ip> -p tcp --dport 80 -j DNAT --to 10.1.0.12:80 iptables -A INPUT -p tcp -i eth0 -d <ext ip> --dport 80 -m state --state NEW -j ACCEPT iptables -A FORWARD -p tcp -i eth0 -o eth1 -d <ext ip> --dport 80 -m state --state NEW -j ACCEPT
However, it keep droping the packets when getting to the NAT box.
Logs ==== (With iptables -A FORWARD -d 10.1.0.12 -j LOG; iptable -A FORWARD -j DROP)
kernel: IN=eth0 OUT=eth1 SRC=202.xxx.122.xxx DST=10.1.0.12 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=6491 DF PROTO=TCP SPT=4023 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0
Any clues? Did I miss something here?
( caveat, this is a quick email during a lunch break at work, so it's all "best guess" )
The rules in the PREROUTING table are executed before those in the FORWARD table, so the packet has a destination of 10.1.0.12 when it hits the FORWARD table. So your third line should be
iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 10.1.0.12 --dport 80 -m state --state NEW -j ACCEPT
Let me know how you get on :)
Here are what I have now =================== iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT
iptables -t nat -A PREROUTING -i eth0 -d <ext ip - an alias ip> -p tcp --dport 80 -j DNAT --to 10.1.0.12:80
iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 10.1.0.12 --dport 80 -m state --state NEW -j ACCEPT
iptables -A FORWARD -t filter -i eth1 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -t filter -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Many thanks,
Wilson
