0

I'm trying to forward ports with iptables NAT rules, but it doesn't seem to work.

Example picture

So I want traffic from NAT#1 in a specific port range go to a specific server in a server group and traffic from NAT#2 to another server group.

I have to use the "NAT server" 192.168.1.10 as SNAT otherwise the FW will drop the traffic.

I've tried the following on the "NAT server",

Example A - NAT#1 port 4000 to Server Group A

sudo iptables -t nat -A PREROUTING -p tcp -d 192.168.1.20 --dport 4000 -j DNAT --to-destination 192.168.1.100
sudo iptables -t nat -A POSTROUTING -s 192.168.1.100 -j SNAT --to 192.168.1.10

Example B - NAT#2 port 5000 to Server Group B

sudo iptables -t nat -A PREROUTING -p tcp -d 192.168.1.30 --dport 5000 -j DNAT --to-destination 192.168.1.201
sudo iptables -t nat -A POSTROUTING -s 192.168.1.201 -j SNAT --to 192.168.1.10

UPDATE

I have to use the "NAT server" 192.168.1.10 as SNAT otherwise the FW will drop the traffic.

This works, kind of.

sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family=ipv4 destination address=192.168.1.20 forward-port port=4000-4010 protocol=tcp to-addr=192.168.1.100'
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family=ipv4 destination address=192.168.1.30 forward-port port=4000-4010  protocol=tcp to-addr=192.168.1.200'
sudo firewall-cmd --reload

but not with one zone. As they write in RedHat firewall doc,

A rule is associated with a particular zone. A zone can have several rules. If some rules interact or contradict, the first rule that matches the packet applies.

So I have to use two zones. Is this possible with two aliases?!?

UPDATE

This worked...

firewall-cmd --permanent --direct --add-rule ipv4 nat PREROUTING 0  -p tcp -m tcp -d "nat_alias" --dport "ext_port" -j DNAT --to-destination "server_ip":"int_port"
firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -m state -p tcp -d "server_ip" --dport "int_port" --state NEW,ESTABLISHED,RELATED -j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -t nat -p tcp -m tcp -s "server_ip" --sport "int_port" -j SNAT --to-source "nat_ip"
0

You should do NAT/SNAT first after that you use NAT/SNAT ip address to forward port.Maybe you need to separate iptable rules.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.