I want to forward traffic between two subnets, I'm not very familiar with iptables. The forwarding works except when iptables is enabled. There must be something wrong with the rules, though intuitively they seem like they should work.
These are the rules I've tried, I've also tried them without destination and source addresses...
Chain INPUT (policy DROP 76 packets, 6424 bytes)
pkts bytes target prot opt in out source destination
52 6866 ACCEPT all -- lo any anywhere anywhere
1117 92168 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
1 152 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
Chain FORWARD (policy DROP 24 packets, 1812 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- eth0 eth0:0 anywhere 184.107.60.0/24
0 0 ACCEPT all -- eth0:0 eth0 184.107.60.0/24 anywhere
Chain OUTPUT (policy ACCEPT 95 packets, 9660 bytes)
pkts bytes target prot opt in out source destination
Chain sshguard (0 references)
pkts bytes target prot opt in out source destination
Just for good measure here is my ifconfig...
eth0 Link encap:Ethernet HWaddr 00:25:90:25:61:41
inet addr:174.142.61.201 Bcast:174.142.61.223 Mask:255.255.255.224
inet6 addr: fe80::225:90ff:fe25:6141/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:205399 errors:0 dropped:0 overruns:0 frame:0
TX packets:105545 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:251555745 (239.9 MiB) TX bytes:34853743 (33.2 MiB)
Interrupt:16 Memory:d0180000-d01a0000
eth0:0 Link encap:Ethernet HWaddr 00:25:90:25:61:41
inet addr:184.107.60.176 Bcast:184.107.60.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Interrupt:16 Memory:d0180000-d01a0000
I've tried this with different rules that don't specify interfaces and still nothing gets through when iptables is enabled.
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT all -- 184.107.60.0/24 anywhere
ACCEPT all -- anywhere 184.107.60.0/24
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain sshguard (0 references)
target prot opt source destination
DROP all -- email.globaltravelerusa.com anywhere
The rules run on a dedicated server which has its adapter bridged with virtual machines. I need to forward packets between the alias and the main physical interface, because the other IP addresses I am given are on another subnet. The rules currently work if I just have a forward allow policy. Technically that has fixed the problem, but in accepting that solution I learn nothing about what I do with iptables. Obviously IP forwarding is on, and I can access the server from my home computer in another country with iptables configured to allow all forwarding.
The problem is simple: what are the right rules to use for forwarding between subnets? The ones shown do not work, for some reason.
This is working...
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain sshguard (0 references)
target prot opt source destination
DROP all -- 1.93.29.150 anywhere
DROP all -- 42.96.131.14 anywhere
DROP all -- 42.62.3.18 anywhere
iptables -t nat -nvL
cat /proc/sys/net/ipv4/ip_forward
? How are your VMs connected?