I am attempting to solve the following problem:
I have a system which I will henceforth refer to as "Local" that hosts a service on port 80 and port 443, and depends on sending outgoing requests on port 25. It also hosts a separate service on port 22.
I have a system which I will call "Global" that has a globally accessible static IP address and has DNS configured for it, and is capable of accepting incoming requests on port 80, 443, 25, and 222.
Local and Global are connected (via a VPN interface, if it matters) on the reserved subnet 10.0.0.0/24
I want all incoming requests on Global ports 80 and 443 to redirect to Local on ports 80 and 443 respectively. I also want incoming requests on Global port 222 to redirect to Local on port 22 (yes, that is an intentionally different port). In addition, I want all outgoing requests to port 25 from Local to redirect to Global on port 25.
Both Local and Global are modern linux systems with apt, iptables, nftables, and ufw available.
I have tried a variety of iptables configurations with no success.
As far as I can tell a configuration that /should/ work (but doesn't!) is as follows:
Global:
/etc/ufw/before.rules (excerpt)
*nat
:PREROUTING ACCEPT [0:0]
# forward port 222 to Local:22
-A PREROUTING -p tcp --dport 222 -j DNAT --to-destination <Local IP on 10.0.0.0/24 Subnet>:22
# forward port 80 to Local:80
-A PREROUTING -p tcp --dport 80 -j DNAT --to-destination <Local IP on 10.0.0.0/24 Subnet>:80
# forward port 443 to Local:443
-A PREROUTING -p tcp --dport 80 -j DNAT --to-destination <Local IP on 10.0.0.0/24 Subnet>:443
# and forward the responses the other direction
-A POSTROUTING -s 10.0.0.0/24 ! -d 10.0.0.0/24 -j MASQUERADE
COMMIT
Local:
/etc/ufw/before.rules (excerpt)
*nat
:PREROUTING ACCEPT [0:0]
# forward outgoing port 25 to Global:25
-A OUTPUT -p tcp --dport 25 -j DNAT --to-destination <Global IP on 10.0.0.0/24 Subnet>:25
COMMIT
I realize that incoming requests for HTTP can be routed using nginx or apache configuration, but I want a generic solution that is not protocol-dependent and could be used for ssh or other protocols, as this traffic will not necessarily always be HTTP.
Does anyone know how this can be done?
Is there some reason that this type of configuration isn't possible?
FORWARD
chain on the default 'filter' table rather than doing the nat rules in thePREROUTING
chain? The masquerade rule looks right, the others might need to be changed.