Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a scenario: I have 4 server and 3 web inbound requests that I have to allow through a modem/router. the ports are https(ssl)443 ssh22 and http80. All 4 servers want them.

I had set up the server to use port forwarding and remapping like this:

2241->port 22 on ip 192.168.0.41
2242->port 22 on ip 192.168.0.42
2243->port 22 on ip 192.168.0.43
2244->port 22 on ip 192.168.0.44

and so on using 44341(..2..3..4) and 8041(..2..3..4)

I love this set up. Behind the firewall I can use default ports ( I prefer this), from outside I can (as I need to) colon:in.

However two things happened. The modem old router died I bought a new one (expensive) this new tech didn't allow more than 8 ports to be remapped. Bad. Artificial glass ceiling. I then set it up at the customers offices > I went to the customer theirs didn't even have any port forwarding at all, so I bought them a brand new modem router (even more expensive) fearing it would need to do more than 8 ports, and fearing that this kind of port remapping role is now a "premium" feature. I was wrong. The *even*more* expensive new modem router will only allow the ports to be forwarded flatly, it won't allow the ports to be remapped. just forward them on.

SO I digressed massively . But is there a way I can still have port remapping I thought to myself?

can I use something like the following to help me?

iptables -t nat -A PREROUTING -i eth0 -p TCP --dport 2202 -j REDIRECT --to-port 22

is there any reason to avoid this use?

share|improve this question
    
On what machine are you thinking of running iptables? –  Julian May 13 '12 at 20:27
    
Your accounts are merged; you should be able to accept an answer now –  Michael Mrozek May 17 '12 at 11:41
add comment

2 Answers

up vote 2 down vote accepted

As your router does not support port mapping, you can do this either on each hosts for itself or by one host.

To forward incoming traffic on port 2241 to localhost:22, use

iptables -t nat -A PREROUTING -p tcp --dport 2241 -j REDIRECT --to-ports 22    

To forward incoming traffic on 192.168.0.41:2242 to 192.168.0.42:22 you can use DNAT (Destination NAT). You can do this for example by using (there are probable more secure solutions):

echo 1 > /proc/sys/net/ipv4/ip_forward # or use /etc/sysctl.conf
iptables -t nat -A PREROUTING -p tcp --dport 2242 -j DNAT --to-destination 192.168.0.42:22 
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -P FORWARD DROP
iptables -A FORWARD -d 192.168.0.42 -p 22 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
share|improve this answer
    
this is an excellent solution, but it'll need to be stored so it preserves on reboot –  conners May 15 '12 at 20:06
    
@conanman Create a script and call it from /etc/rc.local (depends which distribution you use). –  jofel May 16 '12 at 11:08
    
I have "fixed it" I was using openSUSE. ok check the answer –  conners May 17 '12 at 9:02
    
# iptables -t nat -A PREROUTING -p tcp --dport 2241 -j REDIRECT --to-port 22 # iptables-save > /root/dsl.fw OPENSUSE # echo "iptables-restore < /root/dsl.fw" >> /etc/init.d/boot.local CENTOS RHEL # echo "iptables-restore < /root/dsl.fw" >> /etc/rc.local –  conners May 17 '12 at 13:18
add comment

If you are planning on replacing the router with a linux router thats fine. I like tomato for this but freesco, ddwrt and openwrt will do the job. They will provide a web gui like you are familiar with on a product, use iptables to implement it, and give you the high end features on low-end hardware.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.