Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a server with Zentyal 3.03 (Ubuntu 12.04) LTS. It has 3 network devices:

  • eth0 - dhcp fast internet (I pay for it)
  • eth1 - static slow internet (it's free for the school)
  • eth2 - LAN

I can reach the server with SSH, but I can't reach a LAN server from outside. I have set up portforwarding for port 80, it made no sense.

I used:

sudo iptables -A FORWARD -p tcp -i eth1 --sport 8888 -o eth2 -d 192.168.1.90 -dport 8888 -j ALLOW

I don't know what can help, please ask what to show you.

Please help me and do not send me to an another stackexchange website. (this wolud be the 4th time)

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

You were thinking in a right direction, but used a bit wrong rule.

$ iptables -t nat -A PREROUTING -p tcp -d your_static_ip_of_eth1 \
--dport 8888 -j DNAT --to-destination 192.168.1.90:8888

This rule will forward all traffic that reaches your server with destination port 8888 and with destination ip of its eth1 interface to your internal webserver. If you wish to change it so your server responds at port 80 then replace the port number of the --dport option. If you like to change the port of webserver then change the port of --to-destination option.

I assume that you secured your system with proper set of iptables rules, but for completeness please consider these rules as well:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth2 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8888 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -o eth0 -j ACCEPT
-A FORWARD -o eth1 -j ACCEPT
-A FORWARD -i eth2 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

Also you need the ipv4 routing enabled, so edit /etc/ufw/sysctl.conf and uncomment:

net/ipv4/ip_forward=1
share|improve this answer
    
I will check it tomorrow morning, then I will accept your answer. I kept trying all day and there was no result and I'm very tired... –  androbin Oct 15 '12 at 18:56
    
OP quite possibly needs the FORWARD rule too. OP may need both rules. The nat rule to rewrite the destination, then the FORWARD rule to allow the traffic. In addition, OP may need to turn on IP forwarding. –  derobert Oct 15 '12 at 20:41
    
@derobert I assume the OP has forwarding rules in place as his setup is not trivial already. However I will provide one for completeness –  Serge Oct 15 '12 at 20:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.