Having Linux port remap to itself

Question

I have a scenario: I have 4 server and 3 web inbound requests that I have to allow through a modem/router. the ports are https(ssl)443 ssh22 and http80. All 4 servers want them.

I had set up the server to use port forwarding and remapping like this:

2241->port 22 on ip 192.168.0.41
2242->port 22 on ip 192.168.0.42
2243->port 22 on ip 192.168.0.43
2244->port 22 on ip 192.168.0.44

and so on using 44341(..2..3..4) and 8041(..2..3..4)

I love this set up. Behind the firewall I can use default ports ( I prefer this), from outside I can (as I need to) colon:in.

However two things happened. The modem old router died I bought a new one (expensive) this new tech didn't allow more than 8 ports to be remapped. Bad. Artificial glass ceiling. I then set it up at the customers offices > I went to the customer theirs didn't even have any port forwarding at all, so I bought them a brand new modem router (even more expensive) fearing it would need to do more than 8 ports, and fearing that this kind of port remapping role is now a "premium" feature. I was wrong. The *even*more* expensive new modem router will only allow the ports to be forwarded flatly, it won't allow the ports to be remapped. just forward them on.

SO I digressed massively . But is there a way I can still have port remapping I thought to myself?

can I use something like the following to help me?

iptables -t nat -A PREROUTING -i eth0 -p TCP --dport 2202 -j REDIRECT --to-port 22

is there any reason to avoid this use?

Answer 1

As your router does not support port mapping, you can do this either on each hosts for itself or by one host.

To forward incoming traffic on port 2241 to localhost:22, use

iptables -t nat -A PREROUTING -p tcp --dport 2241 -j REDIRECT --to-ports 22    

To forward incoming traffic on 192.168.0.41:2242 to 192.168.0.42:22 you can use DNAT (Destination NAT). You can do this for example by using (there are probable more secure solutions):

echo 1 > /proc/sys/net/ipv4/ip_forward # or use /etc/sysctl.conf
iptables -t nat -A PREROUTING -p tcp --dport 2242 -j DNAT --to-destination 192.168.0.42:22 
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -P FORWARD DROP
iptables -A FORWARD -d 192.168.0.42 -p 22 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

Answer 2

If you are planning on replacing the router with a linux router thats fine. I like tomato for this but freesco, ddwrt and openwrt will do the job. They will provide a web gui like you are familiar with on a product, use iptables to implement it, and give you the high end features on low-end hardware.