Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've ppp0 --> eth1 and eth0 (internal lan). I need forwarding externel 10022 port to port 8999 of the server 192.168.1.254

iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 10022 -j DNAT --to 192.168.1.254:8999
iptables -A FORWARD -p tcp -d 192.168.1.254 --dport 10022 -j ACCEPT

I also have:

cat /proc/sys/net/ipv4/conf/ppp0/forwarding 

1

connection time-out... any idea?

iptables -L -nv

Chain INPUT (policy DROP 14 packets, 1609 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  -f  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
 2037  136K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 ACCEPT     icmp --  ppp0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  tap0   *       0.0.0.0/0            0.0.0.0/0           
   14  1609 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 TCPMSS     tcp  --  *      ppp2    0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 tcpmss match 1400:1536 TCPMSS clamp to PMTU 
    0     0 TCPMSS     tcp  --  *      eth1    0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 tcpmss match 1400:1536 TCPMSS clamp to PMTU 
    0     0 TCPMSS     tcp  --  *      eth0    0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 tcpmss match 1400:1536 TCPMSS clamp to PMTU 
    0     0 TCPMSS     tcp  --  *      ppp0    0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 tcpmss match 1400:1536 TCPMSS clamp to PMTU 
   16  2368 ACCEPT     all  --  *      *       0.0.0.0/0            192.168.1.0/24      state RELATED,ESTABLISHED 
    0     0 ACCEPT     all  --  *      *       192.168.1.0/24       0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  -f  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
 3097 4268K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW,RELATED,ESTABLISHED 
share|improve this question

migrated from serverfault.com Jul 15 '13 at 20:28

This question came from our site for professional system and network administrators.

    
whole bunch of useful examples for iptables here: thegeekstuff.com/scripts/iptables-rules –  Sirex Jul 15 '13 at 20:16
    
also give us other policy details using iptables -L -n -v –  Rahul Patil Jul 15 '13 at 20:47
    
Can you telnet to 192.168.1.254 8999. telnet 192.168.1.254 8999. Also type netstat -ntl and post the output. –  Manula Waidyanatha Jul 16 '13 at 3:25

1 Answer 1

You need to set IP forwarding on eth0 too. Use

sysctl -p net.ipv4.ip_forward=1

The -p makes the change persistent over reboots. Also, I could be wrong, but I thought the top line should be :

iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 10022 -j DNAT --to-destination 192.168.1.254:8999
share|improve this answer
    
Hi and thanks. I already have IP fw to eth0. Also modify with your line, does not work. –  Pol Hallen Jul 15 '13 at 19:47
    
you can abbreviate the iptables options. --to is the same as --to-destination –  Sirex Jul 15 '13 at 20:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.