-2

I am facing issues in iptables rules.

Requirement is to nat incoming request from server A on port 9443 to 443 of server B.

In my scenario.,

  • Server A 10.10.8.33 - - iptables configured here.
  • Server B 10.21.2.31 - - web server.

I have configured these rules

iptables -t nat -A PREROUTING -p tcp --dport 9443 -j DNAT --to-destination10.21.2.31:443

iptables -t nat -A POSTROUTING -p tcp -d 10.21.2.31 --dport 9443 -j SNAT --to-source 10.10.8.33:9443

Which is not working?.

I am trying to browse https://10.10.8.33:9443 from my local windows 10 machine C.. IP 10.21.2.93.

Elaborating my request... incoming request to server A on 9443 should be NAT to 443 on server B, and C will be able to get the page.

Requesting for help.

0

if you need to do only to perform a DNAT, the rule that you have placed in POSTROUTING is not necessary (so you can remove it), the SNAT rule is necessary in case of full NAT. About your DNAT rule this is wrong because in the parameter --dport you need to place the port that you call from the outside of the Server A (9443). So the right rule would be this:

iptables -t nat -A PREROUTING -d 10.10.8.33/32 -p tcp -m tcp --dport 9443 -j DNAT --to-destination 10.21.2.31:443

EDIT:

@Sandy your question it's not so clear.. So I hope to have understand properly what you want to accomplish.

Just to recap what you want to and what are the issues:

  • Reach the Server B from the PC C passing through Server A by calling it on port TCP 9443 (DNAT rule from 9443 to 443)
  • Server B and PC C are in the same subnet
  • Since Server B and PC C are in the same subnet the DNAT itself is not working because the Server B reply directly to the PC C and this is why you need an SNAT rule

So the previous DNAT that I have proposed should be correct but you need also to masquerade (with SNAT) the request coming from PC C with the IP of the Server A. The SNAT rule for masquerade the request from PC C should be:

iptables -t nat -A POSTROUTING -s 10.21.2.93/32 -d 10.21.2.31/32 -p tcp -m tcp --dport 443 -j SNAT --to-source 10.10.8.33

The network topology is that one in the picture? If this is the topology (or pretty similar) there is a particular reason for using iptables instead of implementing an Apache, nginx or HAProxy as a reverse proxy? network scheme

  • Thanks DarkVex for yours revert. I want full NAT and hence i had added SNAT in my query. Furthermore , yes --dport shud be 9443, it was typo. I am now editing the same. But still below rule isn't working? iptables -t nat -A PREROUTING -p tcp --dport 9443 -j DNAT --to-destination10.21.2.31:443 iptables -t nat -A POSTROUTING -p tcp -d 10.21.2.31 --dport 9443 -j SNAT --to-source 10.10.8.33:9443 Please let me know where i m doing wrong ? – Sandy Jun 15 '17 at 17:53
  • @roaima.. Apologies for inconvenience. I have edited the question. – Sandy Jun 15 '17 at 18:04
  • Any help please? – Sandy Jun 20 '17 at 4:01
  • @Sandy I have modified my previous answer – DarkVex Jun 20 '17 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.