Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I need a temporary redirection of some ports to another machine. I've tried:

iptables -t nat -A PREROUTING -p tcp --dport 4321 -j DNAT --to-destination 192.168.121.4:80

But shorewall blocks all packages. So I've tried:

 iptables -A FORWARD -d 192.168.121.4 -p tcp --dport 80 -j ACCEPT

Which is also not working. So how can I redirect/forward the port 4321 proberly to port 80 on machine 192.168.121.4?

And how can I afterwards unredirect/unforward this? I've also set:

sysctl net.ipv4.ip_forward=1

I'm on Linux/Ubuntu 12.04

iptables-save:

# Generated by iptables-save v1.4.12 on Mon Jun 23 12:53:49 2014
*raw
:PREROUTING ACCEPT [5287371:7459454675]
:OUTPUT ACCEPT [4550885:6177804756]
COMMIT
# Completed on Mon Jun 23 12:53:49 2014
# Generated by iptables-save v1.4.12 on Mon Jun 23 12:53:49 2014
*nat
:PREROUTING ACCEPT [227:17856]
:INPUT ACCEPT [33:2188]
:OUTPUT ACCEPT [53:3832]
:POSTROUTING ACCEPT [53:3832]
:eth0_masq - [0:0]
-A PREROUTING -p tcp -m tcp --dport 4321 -j DNAT --to-destination 192.168.121.4:80
-A PREROUTING -p tcp -m tcp --dport 4321 -j DNAT --to-destination 192.168.121.4:80
-A POSTROUTING -o eth0 -j eth0_masq
-A eth0_masq -s 169.254.0.0/16 -j MASQUERADE
-A eth0_masq -s 192.168.121.0/24 -j MASQUERADE
COMMIT
# Completed on Mon Jun 23 12:53:49 2014
# Generated by iptables-save v1.4.12 on Mon Jun 23 12:53:49 2014
*mangle
:PREROUTING ACCEPT [5287371:7459454675]
:INPUT ACCEPT [5081977:7360915410]
:FORWARD ACCEPT [205394:98539265]
:OUTPUT ACCEPT [4550885:6177804756]
:POSTROUTING ACCEPT [4756960:6276393466]
:tcfor - [0:0]
:tcin - [0:0]
:tcout - [0:0]
:tcpost - [0:0]
:tcpre - [0:0]
-A PREROUTING -j tcpre
-A INPUT -j tcin
-A FORWARD -j MARK --set-xmark 0x0/0xff
-A FORWARD -j tcfor
-A OUTPUT -j tcout
-A POSTROUTING -j tcpost
COMMIT
# Completed on Mon Jun 23 12:53:49 2014
# Generated by iptables-save v1.4.12 on Mon Jun 23 12:53:49 2014
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:%Invalid - [0:0]
:Broadcast - [0:0]
:Drop - [0:0]
:Invalid - [0:0]
:NotSyn - [0:0]
:Reject - [0:0]
:dynamic - [0:0]
:eth0_fwd - [0:0]
:eth0_in - [0:0]
:fw2net - [0:0]
:fw2sky - [0:0]
:logdrop - [0:0]
:logflags - [0:0]
:logreject - [0:0]
:net2fw - [0:0]
:net2sky - [0:0]
:net_frwd - [0:0]
:reject - [0:0]
:shorewall - [0:0]
:sky2fw - [0:0]
:sky2net - [0:0]
:smurflog - [0:0]
:smurfs - [0:0]
:tcpflags - [0:0]
:wlan0_fwd - [0:0]
:wlan0_in - [0:0]
-A INPUT -m conntrack --ctstate INVALID,NEW -j dynamic
-A INPUT -i eth0 -j eth0_in
-A INPUT -i wlan0 -j wlan0_in
-A INPUT -i eth1 -j sky2fw
-A INPUT -i lo -j ACCEPT
-A INPUT -j Reject
-A INPUT -j LOG --log-prefix "Shorewall:INPUT:REJECT:" --log-level 6
-A INPUT -g reject
-A FORWARD -i eth0 -j eth0_fwd
-A FORWARD -i wlan0 -j wlan0_fwd
-A FORWARD -i eth1 -o wlan0 -j sky2net
-A FORWARD -i eth1 -o eth0 -j sky2net
-A FORWARD -j Reject
-A FORWARD -j LOG --log-prefix "Shorewall:FORWARD:REJECT:" --log-level 6
-A FORWARD -g reject
-A FORWARD -d 192.168.121.4/32 -p tcp -m tcp --dport 4242 -j ACCEPT
-A FORWARD -d 192.168.121.4/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -j fw2net
-A OUTPUT -o wlan0 -j fw2net
-A OUTPUT -o eth1 -j fw2sky
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -j ACCEPT
-A %Invalid -m conntrack --ctstate INVALID -j DROP
-A Broadcast -m addrtype --dst-type BROADCAST -j DROP
-A Broadcast -m addrtype --dst-type MULTICAST -j DROP
-A Broadcast -m addrtype --dst-type ANYCAST -j DROP
-A Broadcast -d 224.0.0.0/4 -j DROP
-A Drop
-A Drop -p tcp -m tcp --dport 113 -m comment --comment Auth -j reject
-A Drop -j Broadcast
-A Drop -p icmp -m icmp --icmp-type 3/4 -m comment --comment "Needed ICMP types" -j ACCEPT
-A Drop -p icmp -m icmp --icmp-type 11 -m comment --comment "Needed ICMP types" -j ACCEPT
-A Drop -j Invalid
-A Drop -p udp -m multiport --dports 135,445 -m comment --comment SMB -j DROP
-A Drop -p udp -m udp --dport 137:139 -m comment --comment SMB -j DROP
-A Drop -p udp -m udp --sport 137 --dport 1024:65535 -m comment --comment SMB -j DROP
-A Drop -p tcp -m multiport --dports 135,139,445 -m comment --comment SMB -j DROP
-A Drop -p udp -m udp --dport 1900 -m comment --comment UPnP -j DROP
-A Drop -p tcp -j NotSyn
-A Drop -p udp -m udp --sport 53 -m comment --comment "Late DNS Replies" -j DROP
-A Invalid -m conntrack --ctstate INVALID -j DROP
-A NotSyn -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A Reject
-A Reject -p tcp -m tcp --dport 113 -m comment --comment Auth -j reject
-A Reject -j Broadcast
-A Reject -p icmp -m icmp --icmp-type 3/4 -m comment --comment "Needed ICMP types" -j ACCEPT
-A Reject -p icmp -m icmp --icmp-type 11 -m comment --comment "Needed ICMP types" -j ACCEPT
-A Reject -j Invalid
-A Reject -p udp -m multiport --dports 135,445 -m comment --comment SMB -j reject
-A Reject -p udp -m udp --dport 137:139 -m comment --comment SMB -j reject
-A Reject -p udp -m udp --sport 137 --dport 1024:65535 -m comment --comment SMB -j reject
-A Reject -p tcp -m multiport --dports 135,139,445 -m comment --comment SMB -j reject
-A Reject -p udp -m udp --dport 1900 -m comment --comment UPnP -j DROP
-A Reject -p tcp -j NotSyn
-A Reject -p udp -m udp --sport 53 -m comment --comment "Late DNS Replies" -j DROP
-A eth0_fwd -m conntrack --ctstate INVALID,NEW -j dynamic
-A eth0_fwd -m conntrack --ctstate INVALID,NEW -j smurfs
-A eth0_fwd -p tcp -j tcpflags
-A eth0_fwd -j net_frwd
-A eth0_in -m conntrack --ctstate INVALID,NEW -j dynamic
-A eth0_in -m conntrack --ctstate INVALID,NEW -j smurfs
-A eth0_in -p udp -m udp --dport 67:68 -j ACCEPT
-A eth0_in -p tcp -j tcpflags
-A eth0_in -j net2fw
-A fw2net -p udp -m udp --dport 67:68 -j ACCEPT
-A fw2net -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A fw2net -p udp -m udp --dport 53 -m comment --comment DNS -j ACCEPT
-A fw2net -p tcp -m tcp --dport 53 -m comment --comment DNS -j ACCEPT
-A fw2net -p icmp -j ACCEPT
-A fw2net -j ACCEPT
-A fw2sky -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A fw2sky -j ACCEPT
-A logdrop -j DROP
-A logflags -j LOG --log-prefix "Shorewall:logflags:DROP:" --log-level 6 --log-ip-options
-A logflags -j DROP
-A logreject -j reject
-A net2fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A net2fw -j %Invalid
-A net2fw -p tcp -m tcp --dport 22 -m comment --comment SSH -j ACCEPT
-A net2fw -p tcp -m multiport --dports 4242,4243,24800 -j ACCEPT
-A net2fw -p icmp -m icmp --icmp-type 8 -m comment --comment Ping -j ACCEPT
-A net2fw -p icmp -m icmp --icmp-type 8 -m comment --comment Ping -j DROP
-A net2fw -p tcp -m tcp --dport 80 -j ACCEPT
-A net2fw -j Drop
-A net2fw -j LOG --log-prefix "Shorewall:net2fw:DROP:" --log-level 6
-A net2fw -j DROP
-A net2sky -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A net2sky -j %Invalid
-A net2sky -j Drop
-A net2sky -j LOG --log-prefix "Shorewall:net2sky:DROP:" --log-level 6
-A net2sky -j DROP
-A net_frwd -o eth0 -j ACCEPT
-A net_frwd -o wlan0 -j ACCEPT
-A net_frwd -o eth1 -j net2sky
-A reject -m addrtype --src-type BROADCAST -j DROP
-A reject -s 224.0.0.0/4 -j DROP
-A reject -p igmp -j DROP
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -p udp -j REJECT --reject-with icmp-port-unreachable
-A reject -p icmp -j REJECT --reject-with icmp-host-unreachable
-A reject -j REJECT --reject-with icmp-host-prohibited
-A sky2fw -m conntrack --ctstate INVALID,NEW -j dynamic
-A sky2fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A sky2fw -j ACCEPT
-A sky2net -m conntrack --ctstate INVALID,NEW -j dynamic
-A sky2net -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A sky2net -j ACCEPT
-A smurflog -j LOG --log-prefix "Shorewall:smurfs:DROP:" --log-level 6
-A smurflog -j DROP
-A smurfs -s 0.0.0.0/32 -j RETURN
-A smurfs -m addrtype --src-type BROADCAST -g smurflog
-A smurfs -s 224.0.0.0/4 -g smurflog
-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -g logflags
-A tcpflags -p tcp -m tcp --sport 0 --tcp-flags FIN,SYN,RST,ACK SYN -g logflags
-A wlan0_fwd -m conntrack --ctstate INVALID,NEW -j dynamic
-A wlan0_fwd -m conntrack --ctstate INVALID,NEW -j smurfs
-A wlan0_fwd -p tcp -j tcpflags
-A wlan0_fwd -j net_frwd
-A wlan0_in -m conntrack --ctstate INVALID,NEW -j dynamic
-A wlan0_in -m conntrack --ctstate INVALID,NEW -j smurfs
-A wlan0_in -p udp -m udp --dport 67:68 -j ACCEPT
-A wlan0_in -p tcp -j tcpflags
-A wlan0_in -j net2fw
COMMIT
# Completed on Mon Jun 23 12:53:49 2014
share|improve this question
    
@jofel: iptables-save output is definitely the more terse and readable version here. –  0xC0000022L Jun 23 at 8:22
    
@tuxtimo Please post the output of iptables-save (not iptables -L -v ...). @0xC0000022L thanks for the hint. –  jofel Jun 23 at 8:34
    
I've updated the post –  tuxtimo Jun 23 at 10:57
1  
In your Q the destination IP is 192.168.77.4 but in your ruleset the destination IP is 192.168.121.4. Which one is it? –  Creek Jun 23 at 15:33
    
It is 192.168.121.4 –  tuxtimo Jun 24 at 6:51

2 Answers 2

You need at least

iptables -I FORWARD 0 -d 192.168.77.4 -p tcp --dport 80 -j ACCEPT

With -I FORWARD 0 you insert your own rule before the shorewall firewall rules which have a generic reject rule in the FORWARD chain.

Additionally, the destination port is rewritten before the FORWARD chain is processed.

The NAT system automatically cares of the traffic back.

The better way would be to configure shorewall that it automatically includes appropriate FORWARD rules.

share|improve this answer
    
It worked, Thank you! The way you mentioned with -I FORWARD 0 did not work - but with -I FORWARD 1 it worked... Why this? The error was: 'Invalid rule number'0''? –  tuxtimo Jun 24 at 8:11

Now I realize this is not exactly the solution you had in mind, but I'd like to point you and future internauts with similar questions to rinetd(8), the "redirection server" for TCP traffic.

Note that this doesn't require any extra forwarding/routing or DNAT (nat table in iptables) magic, provided the outbound traffic to the forwarded-to server and port is allowed and the inbound traffic to the port which rinetd listens on (to forward the traffic) is allowed as well.

This only works for TCP. But it's a lightweight solution that has helped me migrate servers without any noticeable downtime on a slim budget (yeah, I know there are other and more seamless solutions for a deeper pocket).

share|improve this answer
    
I didn't know rinetd - seems pretty cool but I think it does not fit my needs since I want a temporary redirection. So I want to be able to redirect and unredirect ports at run time of the server... –  tuxtimo Jun 24 at 6:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.