Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have one server where iptables configured with all chains DROP in filter table

eth0 :- 10.0.0.2 [ Intranet assume as LAN ]
eth2 :- 172.16.0.2 [ External clients assume as WAN ]

Now What I am trying to achieving is , when client[172.16.0.1] HIT Port 80 On 172.16.0.2 then it should be nat to internal LAN IP that is 10.0.0.100.

What I have configured to achieve the same [INPUT,OUTPUT,FORWARD Policy is Drop in Filter Chains]

iptables  -A INPUT -s 172.16.0.1/32 -d 172.16.0.2/32 -i eth2 -p tcp -m tcp --dport 80 -j ACCEPT
iptables  -A FORWARD -s 172.16.0.1/32 -j LOG --log-prefix "** TRACING FORWARD CHAIN **" 
iptables  -A FORWARD -s 172.16.0.1/32 -d 10.0.0.100/32 -i eth2 -o eth0 -j ACCEPT
iptables  -A OUTPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
iptables  -t nat -A PREROUTING -s 172.16.0.1/32 -d 172.16.0.2/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0.100:80

net.ipv4.ip_forward = 1 in sysctl.conf

In Logs:

[17385.347409] ** TRACING FORWARD CHAIN **IN=eth2 OUT=eth0 MAC=xxxxxxxx SRC=172.16.0.1 DST=10.0.0.100 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=9864 DF PROTO=TCP SPT=52874 DPT=80 WINDOW=8192 RES=0x00 SYN URGP=0

Now When I Set FORWARD POLICY ACCEPT then it is working but not working with Forward Drop Policy.

So can anyone help me to understand forward policy and which rules should be added in forward policy.

share|improve this question
    
In the description I read "eth0, eth1", in the code I read "eth2"... –  Hauke Laging Feb 24 '13 at 18:15
    
Opss, that was mistake now it is corrected –  Rahul Patil Feb 24 '13 at 18:29

1 Answer 1

This does not really make sense:

iptables  -A OUTPUT -p tcp -m state --state ESTABLISHED -j ACCEPT

should be

iptables  -A FORWARD -m state --state ESTABLISHED -j ACCEPT

and should be the first FORWARD rule. The logging should probably be limited to new connections:

iptables  -A FORWARD -s 172.16.0.1/32 -m conntrack --ctstate NEW -j LOG --log-prefix "** TRACING FORWARD CHAIN **"

Edit 1

In case this system is not the gateway for 10.0.0.100 (the default gateway or at least the gateway for 172.16.0.0) you also need SNAT:

iptables -t nat -A POSTROUTING -s 172.16.0.1/32 -d 10.0.0.100 -j SNAT --to-source 10.0.0.x # the eth0 IP

Use tcpdump to check what packets leave the system via eth0 and which come back.

share|improve this answer
    
Thanks, let me try.. –  Rahul Patil Feb 24 '13 at 18:24
    
can you tell whey OUTPUT EST not required ?? –  Rahul Patil Feb 24 '13 at 18:26
    
it's not working.. –  Rahul Patil Feb 24 '13 at 18:28
    
@RahulPatil answer edited –  Hauke Laging Feb 24 '13 at 20:56
    
@RahulPatil The OUTPUT chain works on packets which have been created on the system. Read a tutorial about Netfilter basics. If you would open 10.0.0.100 in a browser that runs on this system then the packets created by the browser process would enter the OUTPUT chain. It is completely irrelevant to forwarding. So is INPUT BTW. Your input rule is useless (never matches). –  Hauke Laging Feb 24 '13 at 23:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.