Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

INTERNET<->(wan)BRIDGED_DEVICE(lan)<->ETH_ROUTER<->LAN

Problem:
Need to access web server on BRIDGED_DEVICE's LAN from INTERNET via ROUTER (BRIDGED_DEVICE web server cannot be accessed form INTERNET since it has no Public management IP).

Attempt:
Create a secondary/alias WAN Interface on ETH_ROUTER (e.g Primary: eth0.1 (for internet access) and Secondary: eth0.2 (for accessing web server on BRIDGED_DEVICE), (No VLANs).

  • eth0.1 has a public IP;
  • eth0.2 has a static private IP in the BRIDGED_DEVICE's subnet (e.g 10.0.X.Y).

Iptables on ETH_ROUTER: Added a port forward (DNAT) from eth0.1 to eth0.2:

iptables -t nat -I PREROUTING -i eth0.1 -p tcp --dport 80 -j DNAT --to-destination 10.0.X.Y
iptables -t nat -I POSTROUTING -o eth0.2 -s 10.0.X.0/24 -j MASQUERADE

Stateful firewall w/ overall drop policy on FORWARD chain, hence:

 iptables -I FORWARD -i eth0.1 -d 10.0.X.Y -p tcp --dport 80 -j ACCEPT

Can ping from ETH_ROUTER to BRIDGED_DEVICE but unable to reach the web server from Internet. I see packet cont increasing for the DNAT rule but not sure where it disappears in the ETH_ROUTER after that.

ETH_ROUTER is the only device that can be configured to achieve this.

If familiar with this scenario, please suggest what I may be missing or doing wrong here or suggest techniques to debug?

share|improve this question

1 Answer 1

Check default gateway on bridged device and forwarding rule from bridged device to internet also. If you don't care about internet source ip you can add a source nat from router to bridged device.

share|improve this answer
    
Sorry, forgot to mention that I cannot configure the bridged device, have to do everything on ETH_ROUTER. Thanks. –  user3612611 Jun 9 at 18:52
    
Well, so you have to dnat in first place to redirect packet to brdged device and than snat or masquerade packet to let bridged device believe that them comes from router. –  user70760 Jun 10 at 14:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.