Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have setup a network as in the image below:

enter image description here

Firewall (FW) running CentOS 6 has two physical interfaces with subinterfaces:
eth0:2 — 10.100.1.78/25
eth0:3 — 10.100.1.79/25
eth3 — 192.168.0.21/24
eth3:1 — 192.168.1.21/24

The task is to forward packets from Host C to either Host A or Host B on port 990. There is no router in the network and hosts don't see each other.

My solution:
Host C needs to connect to Host A.
Host C sends a packet destined to FW (10.100.1.79, eth0:3) on port 990.
FW receives it on eth0:3 and forwards it to Host A (192.168.0.21) with the same port 990

iptables is empty and ACCEPT all policy is set, thus no packet is blocked. Here are the NAT rules:

iptables -A PREROUTING -t nat -p tcp -d 10.100.1.79 --dport 990 -j DNAT --to 192.168.0.21:990
iptables -A POSTROUTING -t nat -d 192.168.0.21 -p tcp -m tcp --dport 990 -j SNAT --to-source 10.100.1.79
iptables -A FORWARD -p tcp -i eth0:3 -d 192.168.0.22 --dport 990 -j ACCEPT

There is no service listening on port 990 on FW

PORT      STATE SERVICE
22/tcp    open  ssh
23/tcp    open  telnet
25/tcp    open  smtp
111/tcp   open  rpcbind
631/tcp   open  ipp
10000/tcp open  snet-sensor-mgmt

Here is the ip route:

10.100.1.0/25 dev eth0  proto kernel  scope link  src 10.100.1.76
192.168.1.0/24 dev eth3  proto kernel  scope link  src 192.168.1.21
192.168.0.0/24 dev eth3  proto kernel  scope link  src 192.168.0.21

When I try telnet localhost 990, the following message appears:

Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused

How can I accomplish the initial task? Do I have to have a service:990 running in order to forward packets?

share|improve this question
    
There is no router in the network and hosts don't see each other. I think this is wrong and you are actually using the FW as a router. Please think of reviewing the question. –  Alan Jan 23 at 15:22
    
Thank you, Alan. The host C doesn't have a default gateway, so it doesn't see the other network. I should clarify the question: Is it possible for iptables to receive a packet specifically sent to FW's ipAddress:990 and port forward it out to Host B's ipAddress:990? (with no service listening on port 990 on FW) –  gizat Jan 23 at 15:39
    
I may sound strange, and I am starting to think that it's not possible, but just needed a documented support, if such exist :-) –  gizat Jan 23 at 15:40
    
What happens if you telnet to 10.100.1.79 instead of to 127.0.0.1? –  Jenny D Jan 23 at 16:10

1 Answer 1

Try changing this from 21 to 22.

iptables -A PREROUTING -t nat -p tcp -d 10.100.1.79 --dport 990 -j DNAT --to 192.168.0.22:990

And dropping the:

iptables -A POSTROUTING -t nat -d 192.168.0.21 -p tcp -m tcp --dport 990 -j SNAT --to-source 10.100.1.79

I'll explain if it solves the problem.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.