Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to forward traffic between two subnets, I'm not very familiar with iptables. The forwarding works except when iptables is enabled. There must be something wrong with the rules, though intuitively they seem like they should work.

These are the rules I've tried, I've also tried them without destination and source addresses...

Chain INPUT (policy DROP 76 packets, 6424 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   52  6866 ACCEPT     all  --  lo     any     anywhere             anywhere            
 1117 92168 ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED 
    1   152 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh 

Chain FORWARD (policy DROP 24 packets, 1812 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  eth0   eth0:0  anywhere             184.107.60.0/24     
    0     0 ACCEPT     all  --  eth0:0 eth0    184.107.60.0/24      anywhere            

Chain OUTPUT (policy ACCEPT 95 packets, 9660 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain sshguard (0 references)
 pkts bytes target     prot opt in     out     source               destination

Just for good measure here is my ifconfig...

eth0      Link encap:Ethernet  HWaddr 00:25:90:25:61:41  
          inet addr:174.142.61.201  Bcast:174.142.61.223  Mask:255.255.255.224
          inet6 addr: fe80::225:90ff:fe25:6141/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:205399 errors:0 dropped:0 overruns:0 frame:0
          TX packets:105545 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:251555745 (239.9 MiB)  TX bytes:34853743 (33.2 MiB)
          Interrupt:16 Memory:d0180000-d01a0000 

eth0:0    Link encap:Ethernet  HWaddr 00:25:90:25:61:41  
          inet addr:184.107.60.176  Bcast:184.107.60.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:16 Memory:d0180000-d01a0000 

I've tried this with different rules that don't specify interfaces and still nothing gets through when iptables is enabled.

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  184.107.60.0/24      anywhere            
ACCEPT     all  --  anywhere             184.107.60.0/24     

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain sshguard (0 references)
target     prot opt source               destination         
DROP       all  --  email.globaltravelerusa.com  anywhere

The rules run on a dedicated server which has its adapter bridged with virtual machines. I need to forward packets between the alias and the main physical interface, because the other IP addresses I am given are on another subnet. The rules currently work if I just have a forward allow policy. Technically that has fixed the problem, but in accepting that solution I learn nothing about what I do with iptables. Obviously IP forwarding is on, and I can access the server from my home computer in another country with iptables configured to allow all forwarding.

The problem is simple: what are the right rules to use for forwarding between subnets? The ones shown do not work, for some reason.

This is working...

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain sshguard (0 references)
target     prot opt source               destination         
DROP       all  --  1.93.29.150          anywhere            
DROP       all  --  42.96.131.14         anywhere            
DROP       all  --  42.62.3.18           anywhere
share|improve this question
1  
And what is the problem? Have you configured the routing tables? Have you checked with tcpdump how the packets move? –  Hauke Laging Feb 16 at 0:56
    
It works with iptables disabled, it doesn't work with iptables enabled so the forwarding rules don't work. –  John Tate Feb 16 at 1:52
    
You don't have masquerading enabled do you? iptables -t nat -nvL –  Patrick Feb 16 at 8:13
    
I don't want NAT, there are both internet subnets. The extra IPs with my server have to be routed to through the IP of eth0, to the network of eth0:0 to reach my virtual machines. It isn't enabled. –  John Tate Feb 16 at 13:49
    
@JohnTate You should tell us the details of the failing connection. Source IP, target IP. What is the output of cat /proc/sys/net/ipv4/ip_forward? How are your VMs connected? –  Hauke Laging Feb 16 at 17:15
show 1 more comment

1 Answer 1

Avoid eth0:0 in Netfilter rules, use eth0 only (if you need it at all).

See: Why doesn't my iptables rule work?

share|improve this answer
    
Tried it without specifying interfaces, still no cigar. –  John Tate Feb 16 at 6:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.