IPTables Forwarding and MASQ not working

Question

I am trying to setup Traffic forwarding and NAT for my VM machines.I am having setup in which there are 2 linux OS i.e. Ubuntu and CENTOS and I want that traffic should be forwarded from Ubuntu to CENTOS and it should NAT with another interface of CENTOS.Please find below configuration on CENTOS

ens33 :- Internal Interface
ens34 :- External Interface

CENTOS and Ubuntu are connected (Host adapater in VM).Below output is for CENTOS

root@localhost ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.16.251.2    0.0.0.0         UG    101    0        0 ens34
172.16.251.0    0.0.0.0         255.255.255.0   U     101    0        0 ens34
192.168.6.0     0.0.0.0         255.255.255.0   U     100    0        0 ens33

I've done below configuration for traffic forwarding and NAT in IPtables on CENTOS

*nat
:PREROUTING ACCEPT [1030:71552]
:INPUT ACCEPT [4:848]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth34 -j MASQUERADE


*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [269:27758]
**-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT**
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
**-A FORWARD -i ens33 -o ens34 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ens34 -o ens33 -j ACCEPT**
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

cat /proc/sys/net/ipv4/ip_forward
1

I've have verified traffic in which traffic is getting forwarded from Ubuntu to CENTOS but looks like NAT and forwrding is not working

192.168.6.2 (IP address of Ubuntu machine)

03:54:20.331164 IP 192.168.6.2 > 8.8.8.8: ICMP echo request, id 34419, seq 791, length 64
03:54:21.339241 IP 192.168.6.2 > 8.8.8.8: ICMP echo request, id 34419, seq 792, length 64

Answer 1

You've swapped the internal and external interfaces in the FORWARD rules. In your setup,

-A FORWARD -i ens33 -o ens34 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ens34 -o ens33 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

an incoming packet from ens33 that wants to open a connection (from the Ubuntu machine, I assume) will match the first line. But there's no established connection, and the packet will get rejected with the last line.

What you need is

-A FORWARD -i ens34 -o ens33 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ens33 -o ens34 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

or even better, make a shell script with placeholders like this:

INTIF=ens33
EXTIF=ens34
# flush rules
iptables -F FORWARD 
iptables -t nat -F
# rules
iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
# more rules if required

Then you can re-use it different situations with different interfaces without getting confused.

I have no idea what are you trying to do in the INPUT chain; I suggest deleting all of those rules to simplify debugging. If forwarding works without those rules and you still need to do something specific in the INPUT chain, please ask a new question.