0

Homework disclaimer...

So I have computer A whose IP address happens to be 192.168.0.81. This computer has a web server installed and exposes port 80. So typing 192.168.0.81 in the web browser address bar of any other computer of this local network displays this webpage.

But I also have another computer in this local network: 192.168.0.129 And my task is to configure the two in such a way that 192.168.0.129 will be a NAT gateway for 192.168.0.81. All packets sent by 192.168.0.81 must go through 192.168.0.129 and 192.168.0.129 must forward all traffic it receives on port 80 to 192.168.0.81.

Solution attempt. Execute this on server to hopefully make it send its responses through 192.168.0.129:

route add default gw 192.168.0.129

Execute this on gateway to hopefully allow it to forward traffic from server to outside world:

echo 1 > /proc/sys/net/ipv4/ip_forward

Execute this on gateway to hopefully make it forward traffic it receives to server:

iptables -t nat -A PREROUTING -p tcp -d 192.168.0.129 --dport 80 -j DNAT --to 192.168.0.81:80

Yet it doesn't work. Typing 192.168.0.129 in the web browser address bar of another computer in this network (192.168.0.185) displays browser error rather than this webpage. What am I doing wrong?

In an effort to somehow find out what's going on I tried logging all packets by issuing on both machines:

iptables -A INPUT -j LOG
iptables -A OUTPUT -j LOG

These are the results. It seems the server receives packets from the original request maker and tries to send some packets back. I'm seeing entries of this sort:

Dec 19 23:23:25 debian kernel: (...) IN= OUT=eth0 MAC=(...) SRC=192.168.0.185 DST=192.168.0.81 LEN=60 TOS=0x00 PREC=(blah blah this and subsequent stuff omitted for brevity)
Dec 19 23:23:25 debian kernel: (...) IN= OUT=eth0 SRC=192.168.0.81 DST=192.168.0.185 LEN=60 TOS=0x00 PREC=(...)

However, gateway's logs don't seem to show any relevant traffic.

How to fix this?

  • You seem to be mixing what is the destination and source... Better drawing in a sheet of poster in this cases. The route also does not seem to be needed. – Rui F Ribeiro Dec 19 '18 at 22:40
  • @RuiFRibeiro Am I? I'm re-reading my Q but can't find such a mistake. Could you point me where I mixed them? – gaazkam Dec 19 '18 at 22:44
  • Kind of late and sleepy here, but in the iptables rule I think it should be tcp -s ....129 (and not -d) – Rui F Ribeiro Dec 19 '18 at 23:05
  • @RuiFRibeiro Not sure, why? My thinking is that the gateway is supposed to forward packets sent to it (hence -d) to the server? With -s 196.168.0.129 the gateway will only forward to the server the packets it sends on its own. Either way, tried putting -s instead of -d, and now the server doesn't seem to receive any packets when ...185 makes its request :( – gaazkam Dec 20 '18 at 9:27
  • Forwarding only works between different subnets. You are trying to route traffic on the same physical (layer 2) network through a gateway, which won't work (unless the .129 machine works like a bridge with two distinct network interfaces, but then again that's not forwarding really, that's bridging). – wurtel Dec 20 '18 at 10:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.