How to properly port forwarding between different machines using UFW / iptables and DD-Wrt?

Question

This is my network

I want to see my ip_camera (192.168.3.4:80) from outside my house. It is on dd-wrt router (192.168.3.1) without internet. The router 192.168.1.1 has internet. However, i have a raspberry server with two interfaces connected to both routers: eth0 192.168.1.0/24 and eth1 192.168.3.0/24.

So, this is what i did:

At router dd-wrt 192.168.1.1, web front end, Port Forwarding section, forwarded from any tcp/ip (from wan) at 10080 to lan 192.168.1.2:10080

Then on Raspberry (with both ifaces eth0 192.168.1.2 and eth1 192.168.3.2), configured UFW like this:

DEFAULT_FORWARD_POLICY="ACCEPT" (/etc/default/ufw)

and

net.ipv4.ip_forward=1 (/etc/ufw/sysctl.conf)

and in before.rules (at the beggining of the file), added following lines:

*nat
:PREROUTING ACCEPT [0:0]
-A PREROUTING -i eth0 -p tcp -d 192.168.1.2 --sport 10080 -j DNAT --to-destination 192.168.3.4:80
COMMIT

So, if i'm on a random client PC (192.168.1.15 for example), i can reach perfectly my camera at browser on address:

http://192.168.1.2:10080

meaning that it works ok. But i can't see my camera from outside the internet.

I tried adding to UFW:

ufw allow proto tcp from any to 192.168.3.4 port 80

and restarted UFW, but not luck.

Can anyone give me a hand please?

I noticed these output tcpdumping my Raspberry Server, when i reach it from internet (179.39.4.14):

03:19:11.324244 IP 179.39.4.14.41346 > 192.168.1.2.10080: Flags [S], seq 2032441512, win 14600, options [mss 1452,sackOK,TS val 16154060 ecr 0,nop,wscale 8], length 0
03:19:27.131917 IP 179.39.4.14.41345 > 192.168.1.2.10080: Flags [S], seq 389083091, win 14600, options [mss 1452,sackOK,TS val 16155640 ecr 0,nop,wscale 8], length 0
03:19:27.359709 IP 179.39.4.14.41346 > 192.168.1.2.10080: Flags [S], seq 2032441512, win 14600, options [mss 1452,sackOK,TS val 16155664 ecr 0,nop,wscale 8], length 0

When i reach it from 192.168.1.15 (my home network)

03:21:54.799050 IP 192.168.1.15.13094 > 192.168.1.2.10080: Flags [S], seq 2661860721, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
03:21:54.802330 IP 192.168.1.2.10080 > 192.168.1.15.13094: Flags [S.], seq 3834946478, ack 2661860722, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 1], length 0
03:21:54.803718 IP 192.168.1.15.13094 > 192.168.1.2.10080: Flags [.], ack 1, win 68, length 0

I observe different effects. On Lan (that is working properly), there is a bidirecctional communication on the way. However, my Raspberry server just can see incoming request from the internet but does not register any return to it. I think the key of my problem is there, but i don't know if i have to edit something in UFW (or somewhere else) to allow this bidirectional exchange.

May be related to "RELATED,ESTABLISHED" concept? i don't know...

many thanks. gtz, Sergio.

Answer 1

Conceptually you want to:

• NAT from 192.168.1.2: (r-Pi server IP?) to 192.168.3.4:80 (camera) [DONE]
  • Check that this port forward works by accessing the camera via 192.168.1.2: [CHECK]
• NAT from 192.168.1.1: to 192.168.1.2: [Not done?]
  • Check that this port forward works by observing the traffic on 192.168.1.2.
• Open port on the outbound router 192.168.1.1 [unknown];

You have correctly done the first step. Now all you need is another mapping between the Internet and your 192.168.1.0/24 network. It is the same process so should be easy to implement. I don't use ufw or dd-wrt so you will need to research how it's done.

Your RELATED,ESTABLISHED rules should not be interfering. These are normally used in the INPUT chain to track known inbound connections and skip the remainder of the rule set.