Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm using this rule to configure SNAT:

iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 193.49.142.107:4000

I want to specify a rule to filter out packets not destined to the internal address and port that initiated the session. Additionally, for receiving packets from a specific external endpoint, it is necessary for the internal endpoint to send packets first to that specific external endpoint's IP address.(NAT Address Dependent Filtering)

Example:

A machine with internal IP and port (X:x) which is behind the NAT opens a connexion to a server with IP Y. So with the rule I must be able to allow only connexion coming from IP address Y and destined to (X:x). All other connexion will be droped.

share|improve this question

1 Answer 1

up vote 2 down vote accepted
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -P FORWARD -j DROP
iptables -A FORWARD -o eth1 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth1 -m state --state ESTABLISHED -j ACCEPT

What do these rules do?

  1. -A POSTROUTING -o eth1 -j MASQUERADE hides your internal IP's as packets leave your network
  2. -P FORWARD -j DROP sets the default policy for your FORWARD chain to DROP
  3. -A FORWARD -o eth1 -m state --state NEW,ESTABLISHED -j ACCEPT allows new and established FORWARDed connections out
  4. -A FORWARD -i eth1 -m state --state ESTABLISHED -j ACCEPT allows only established FORWARDed connections in

The rules above are assuming that you're using this box as a gateway/firewall with eth1 connected to your WAN and eth0 connected to your LAN.

Additional Reading: Postrouting and IP Masquerading

EDIT

To configure "conditional" port forwarding:

By source port

iptables -A PREROUTING -t nat -i eth1 -p tcp --sport [trusted_source_port] --dport [external_port] -j DNAT --to [internal_ip]:[internal_port]
iptables -A FORWARD -p tcp -d [internal_ip] --dport [internal_port] -j ACCEPT

By source IP

iptables -A PREROUTING -t nat -i eth1 -p tcp -s [trusted_source_ip] --dport [external_port] -j DNAT --to [internal_ip]:[internal_port]
iptables -A FORWARD -p tcp -d [internal_ip] --dport [internal_port] -j ACCEPT
share|improve this answer
    
Thanks for your reply. I think, for a session established from (X:x) to (Y:y), these rules allow only packets comming from IP address and port (Y:y). Isn't there a way to allow packets even with a different port number. I mean, allow machine Y to open new sessions to internal machine X. –  HaTiMuX Jun 18 at 12:33
    
Have you tried this? The kernel maintains a list of all connections and it + TCP automagically manage IP/Port communication so you don't have to it manually. However, if you want to allow machine Y to establish new connections on internal machine X then you want to configure port forwarding. Is that correct? –  Creek Jun 18 at 12:51
    
It's rather Port Triggering. It's similar to port forwarding but with additional conditions. According to my last example only machine Y will be allowed to establish new connexions to the internal machine X. We can say that the condition here is that machine X establishes a connexion to the external machine that will be allowed. I hope I was clear. –  HaTiMuX Jun 18 at 13:17
    
I think the only way to do what I described is to get the IP destination Y for a session established from (X:x) to (Y:y) and then add this rule: #iptables -A PREROUTING -t nat -i eth0 -s IP –d X’ –dport x’ -j DNAT --to X:x with X' and x' the external IP and port affected by NAT. Then at the end of all sessions delete the defined rule. Now the problem is how to get the connection information. –  HaTiMuX Jun 18 at 14:35
    
See my answer's update –  Creek Jun 18 at 14:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.