I have a httpd service running on server machine,

I have a firewall

and internet browser on desktop machine.

On server I have a rule that only firewall can access to server:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -s firewall -j ACCEPT

What rules should I have on firewall, that browser on desktop could connect to firewall, and firewall would connect to server for desktop to get the http page and return the page to desktop? In other words, I would like to open a browser on desktop, which will get a page from server through firewall:

   server    <->   firewall    <->   desktop

I have next on firewall, that works if all machines are on the same network, but I do not know if this is the best way to go:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination server
iptables -t nat -A POSTROUTING  -s desktop -j MASQUERADE

Any suggestions please? I am also curious in different types of scenario: all machines are on the same network and desktop is on different network. Thank you very much

  • I have change the description and refrain the answer. Hope now is OK. Thank you for your time. – andrej Dec 26 '14 at 22:28
  • There is no need for NAT to be involved, it is just the solution I came up with, and I am wondering if there is a better one. Why server only allows connection from firewall?: that is how I would like to configure my network to make it more secure. Thank you – andrej Dec 27 '14 at 7:49
  • Yes, I would like to have a router also as a firewall between networks for instance, or have a firewall between computers on the same network. I am still thinking the options. – andrej Dec 27 '14 at 12:17
  • 1
    Let's restate (and delete) all my questions above. I would like to see a clear statement of what you're trying to achieve, what you tried already, why you tried it, and what's wrong with the result. – Pavel Šimerda Dec 27 '14 at 17:13
  • I have tree computers, all on the same network as explained, but i do not like the desktop in iptables -t nat -A POSTROUTING -s desktop -j MASQUERADE , I would like to replace desktop with server – andrej Dec 27 '14 at 22:16

DNAT and SNAT work no matter what the addresses of the affected systems are. If the DNATting system happens to be the router for its subnet and the DNAT target is outside the subnet then SNAT is not necessary as the reply packets reach the system anyway. But it's easier to just ignore that case.

Strange about your code

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination server
iptables -t nat -A POSTROUTING  -s desktop -j MASQUERADE

is that SNAT (MASQUERADE) is limited to desktop as source but DNAT isn't. I would rather do this:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination server
iptables -t nat -A POSTROUTING -m conntrack --ctstate DNAT -j MASQUERADE

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.