0

I have currently set up a home server with a CentOS 6.6 installation on it. The server has two NIC interfaces which I'm using it as my router and DHCP server. Here's a diagram showing the network topology:

Home Network Topology I have gotten this topology to function without any specific port forwarding; however, forwarding certain ports to a specific device does not work. So for example, I am trying to forward port 27015 (along with a bunch of others) to expose the Counter-Strike server I am running on Device 1 to the Internet (Device 1 has a static IP assigned to it), but I cannot get it to work.

Here are the configurations that may provide some insight into why things are not working. Note that I faked the MAC and IP Addresses for the purposes of this question:

/etc/sysconfig/network-scripts/ifcfg-eth0 (NIC connected to the modem):

DEVICE=eth0
HWADDR=00:11:22:33:44:55
TYPE=Ethernet
UUID=aaaaaaaa-bbbb-cccc-dddd-eeeeffff0000
ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=dhcp

/etc/sysconfig/network-scripts/ifcfg-eth1 (NIC connected to the switch):

DEVICE=eth1
TYPE=Ethernet
UUID=11111111-2222-3333-4444-555566667777
ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=none
HWADDR=aa:bb:cc:dd:ee:ff
IPADDR=192.168.1.1
NETMASK=255.255.255.0

/etc/sysconfig/iptables:

*nat
:PREROUTING ACCEPT [3:653]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1200 -j DNAT --to-destination 192.168.1.101:1200 
-A PREROUTING -i eth0 -p udp -m udp --dport 1200 -j DNAT --to-destination 192.168.1.101:1200 
-A PREROUTING -i eth0 -p tcp -m tcp --dport 3478 -j DNAT --to-destination 192.168.1.101:3478 
-A PREROUTING -i eth0 -p udp -m udp --dport 3478 -j DNAT --to-destination 192.168.1.101:3478 
-A PREROUTING -i eth0 -p tcp -m tcp --dport 4379:4380 -j DNAT --to-destination 192.168.1.101:4379-4380 
-A PREROUTING -i eth0 -p udp -m udp --dport 4379:4380 -j DNAT --to-destination 192.168.1.101:4379-4380 
-A PREROUTING -i eth0 -p tcp -m tcp --dport 27000:27050 -j DNAT --to-destination 192.168.1.101:27000-27050 
-A PREROUTING -i eth0 -p udp -m udp --dport 27000:27050 -j DNAT --to-destination 192.168.1.101:27000-27050 
-A POSTROUTING -o eth0 -j MASQUERADE 
COMMIT
*filter
:INPUT ACCEPT [5:1091]
:FORWARD ACCEPT [1:48]
:OUTPUT ACCEPT [1:330]
-A FORWARD -p tcp -m tcp --dport 27015 -j ACCEPT 
-A FORWARD -p udp -m udp --dport 27015 -j ACCEPT 
COMMIT

$ route -n (You can ignore anything that is 10.8.x.x . They are related to Docker)

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
111.111.32.0      0.0.0.0         255.255.224.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1003   0        0 eth1
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
0.0.0.0         111.111.32.1      0.0.0.0         UG    0      0        0 eth0

Any help would be appreciated, as I have read several articles and still cannot figure out what the issue is. Note that the internet can be accessed from all devices with this configuration.

P.S. My question is in bold above. If you missed it, here it is again:

I am trying to forward port 27015 (along with a bunch of others) to expose the Counter-Strike server I am running on Device 1 to the Internet (Device 1 has a static IP assigned to it), but I cannot get it to work.

  • sanity check: run iptables-save, confirm that the rules it shows (which are what are actually loaded in the kernel) match what you expect. – derobert Apr 3 '15 at 8:14
  • Another check, did you enable ip_forwarding? check cat /proc/sys/net/ipv4/ip_forward where output of 0 is disabled and 1 is enabled. – Lambert Apr 3 '15 at 8:23
  • @derobert, the rules do match what I'd expect. I did enable IP forwarding (output is 1). – tugayac Apr 3 '15 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.