> I have tried to get this iptables script on my Centos 4.4 machine > working, with some help, but still have not succeeded in forwarding > port 722 to a machine on the LAN attached to the machine running > iptables attached to the internet. The logging of the FORWARD > packets just before drop tells me they are being forwarded. I also > made sure the the LAN attached machine on eth0 does accept ssh -D > 722 once I logged into the public facing machine via ssh. So I kinda > assume it is the return packet that is the problem, but cannot see > why. Ideas? 333.333.333.333 is substituted for the public IP addr, > 111.111.111.111 222.222.222.222 are machines I want to be the only > ones that can access. eth0 is the LAN NIC and eth1 is the public > facing NIC. > > # Generated by iptables-save v1.2.11 on Thu Dec 15 17:00:25 2005 > *filter [...] > -A FORWARD -j LOG --log-level debug > -A FORWARD -d 192.168.0.0/255.255.255.0 -i eth1 -o eth0 \ > -p tcp -m multiport --dports 22,3306 -m state --state NEW \ > -j ACCEPT So NEW packets forwarded to port 22 will be allowed. > -A FORWARD -i eth1 -o eth0 -m state \ > --state RELATED,ESTABLISHED -j ACCEPT Here you are only accepting packets from eth1 -> eth0 in a RELATED or ESTABLISHED connection. What about the return packets that will go from eth0 -> eth1? I really don't think you can setup a connection this way. Try: -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT Grts, Rob - To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
