I have setup a network as in the image below:
Firewall (FW) running CentOS 6 has two physical interfaces with subinterfaces:
eth0:2 — 10.100.1.78/25
eth0:3 — 10.100.1.79/25
eth3 — 192.168.0.21/24
eth3:1 — 192.168.1.21/24
The task is to forward packets from Host C to either Host A or Host B on port 990. There is no router in the network and hosts don't see each other.
Host C needs to connect to Host A.
Host C sends a packet destined to FW (10.100.1.79, eth0:3) on port 990.
FW receives it on eth0:3 and forwards it to Host A (192.168.0.21) with the same port 990
iptables is empty and ACCEPT all policy is set, thus no packet is blocked. Here are the NAT rules:
iptables -A PREROUTING -t nat -p tcp -d 10.100.1.79 --dport 990 -j DNAT --to 192.168.0.21:990 iptables -A POSTROUTING -t nat -d 192.168.0.21 -p tcp -m tcp --dport 990 -j SNAT --to-source 10.100.1.79 iptables -A FORWARD -p tcp -i eth0:3 -d 192.168.0.22 --dport 990 -j ACCEPT
There is no service listening on port 990 on FW
PORT STATE SERVICE 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 111/tcp open rpcbind 631/tcp open ipp 10000/tcp open snet-sensor-mgmt
Here is the
10.100.1.0/25 dev eth0 proto kernel scope link src 10.100.1.76 192.168.1.0/24 dev eth3 proto kernel scope link src 192.168.1.21 192.168.0.0/24 dev eth3 proto kernel scope link src 192.168.0.21
When I try telnet localhost 990, the following message appears:
Trying 127.0.0.1... telnet: connect to address 127.0.0.1: Connection refused
How can I accomplish the initial task? Do I have to have a service:990 running in order to forward packets?