0

I have a debian box with two interfaces wan and lan(192.168.0.1). On lan:80 I have a site that must be accessed from local network. Also I need this site to be accessed from wan:777. This is my iptables rules:

iptables -A INPUT -i $LAN -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i $WAN --dport 777 -j DNAT --to-destination 192.168.0.1:80
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

However, it doesn't work. It works only if I remove -i $LAN fron INPUT. I mean this way:

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i $WAN --dport 777 -j DNAT --to-destination 192.168.0.1:80
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

However, it is a bad way, because site is now also on wan:80 and this is not what I want. What is my mistake?

| improve this question | | | | |
  • LAN variable is interface address or interface name? – realpclaudio Feb 7 at 6:53
  • @realpclaudio $LAN is interface name. – Pavel Feb 7 at 6:58
0

You may try iptables -A INPUT -d 192.168.0.1 -p tcp --dport 80 -j ACCEPT

It is wrong way to use iptables -A INPUT -i $LAN -p tcp --dport 80 -j ACCEPT

| improve this answer | | | | |
0

If webserver is listening on port 80 then you need to enable that port on INPUT chain. NAT is not enough if destination port is not allowed to be reached, that's why it's working if you do not restrict source interface.

Since destination is the same, can't you just define another virtualhost on WAN:777 port?

| improve this answer | | | | |
0

I got an answer on Russian Linux forum :

iptables -t mangle -A PREROUTING -i $WAN -p tcp --dport 777 -j MARK --set-mark 0x1234
iptables -t nat -A PREROUTING -p tcp -i $WAN --dport 777 -j DNAT --to-destination 192.168.0.1:80
iptables -A INPUT -m mark --mark 0x1234 -j ACCEPT
| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.