My goal is to simply forward packets between two interfaces performing NAT along the way. Specifically, I want to forward packets between a public interface and an external USB NIC.
I made sure the Kernel was configured to allow port forwarding:
$ sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1
As well as interface-specific forwarding configurations:
net.ipv4.conf.enp0s20u4u3.forwarding = 1 net.ipv4.conf.eno1.forwarding = 1
iptables rules I created are:
iptables -t nat -A PREROUTING -i eno1 --protocol tcp --destination-port 10000 -j DNAT --to-destination 192.168.10.2:1234 iptables -A FORWARD -i eno1 -o enp0s20u4u3 --protocol tcp --destination-port 1234 -j ACCEPT iptables -t nat -A POSTROUTING -o enp0s20u4u3 --protocol tcp --source 192.168.10.2 --source-port 1234 -j SNAT --to-source 192.168.10.1
I then tried testing this configuration by attempting to establish a TCP connection over port 10000 (if my external IP was 192.168.2.50).
$ nc -v 192.168.2.50 10000 nc: connect to 192.168.2.50 port 10000 (tcp) failed: Connection refused
This behavior makes sense if my rule entries were incorrect. So, I dumped the rule statistics
$ iptables -t nat -L -v Chain PREROUTING (policy ACCEPT 15 packets, 2885 bytes) pkts bytes target prot opt in out source destination 0 0 DNAT tcp -- eno1 any anywhere anywhere tcp dpt:ndmp to:192.168.10.2:1234 Chain INPUT (policy ACCEPT 15 packets, 2885 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 SNAT tcp -- any enp0s20u4u3 192.168.10.2 anywhere tcp spt:search-agent to:192.168.10.1
So, the inbound TCP packets are not matching against the first
PREROUTING chain rule. I am unsure where the mistake is; the first rule is so simple. The idea is:
Inbound traffic for 192.168.2.50:10000 gets NAT'd to 192.168.10.2:1234 on a private interface.