0

I'm using a gateway connected to VPN to do forwarding with the port of an industrial LAN element.

I use iptables forwarding to access port 80/443 of my gateway in the browser to show me the contents of Port 80/443 of the item:

iptables -t nat -A POSTROUTING -p tcp -d 192.168.1.37 --dport 80 -j MASQUERADE 

iptables -t nat -A POSTROUTING -p tcp -d 192.168.1.37 --dport 443 -j MASQUERADE 

iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j DNAT --to 192.168.1.37:80 

iptables -t nat -A PREROUTING -i br0 -p tcp --dport 443 -j DNAT --to 192.168.1.37:80 

The problem is that that element sometimes changes local IP address, either by rebooting the router or by expiration on the DHCP server; for which we do not have access. To do this I would like to know if it is possible to make the forward instead of By Your IP address by your MAC.

I tried to do something like that but it doesn't work: iptables -t nat -A POSTROUTING -p tcp -m mac --mac-source AA:BB:CC:DD:EE:FF --dport 80 -j MASQUERADE, throwing iptables: Invalid argument. Run 'dmesg' for more information.

UPDATE WITH SCRIPT

To solve this problem I have developed a script in bash that checks the MAC address and returns its IP address to create the iptables rules. The main idea is to launch the script from time to time using crontab.

This is the script:

#!/bin/bash

vpnip=10.2.10.1
subred=192.168.1.0/24
mac=aa:bb:cc:11:22:33 # lowercase
ip=$(nmap -sP $subred >/dev/null && arp -an | grep $mac | awk '{print $2}' | sed 's/[()]//g')


if [  $ip  ]; then
    echo "IP address found: $ip"
    iptables -t nat -A POSTROUTING -p tcp -d $ip --dport 80 -j MASQUERADE 
    iptables -t nat -A POSTROUTING -p tcp -d $ip --dport 443 -j MASQUERADE 
    iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j DNAT --to $ip:80 
    iptables -t nat -A PREROUTING -i br0 -p tcp --dport 443 -j DNAT --to $ip:443
    iptables -t nat -A PREROUTING -d $vpnip -p tcp -m multiport --dports 80,443 -j DNAT --to-destination $ip:80
    iptables --table nat --list 
else
    echo "IP not found"
fi

The script works properly. But, when the iptables rules are periodically released, they are duplicated.

Is there any way to check the existence of these rules before writing them again? Or delete them before you do?

1

Is there any way to check the existence of these rules before writing them again? Or delete them before you do?

You can use -C option for iptables. Check man iptables for more information. I think a neat way would be to create an array with the rules and check the rule for existence before you add it to the chain.

Example script:

#!/bin/bash

ip='1.1.1.1'
ip2='8.8.8.8'

rules=(
"INPUT -s $ip -j DROP"
"INPUT -s $ip2 -j DROP"
)

for rule in "${rules[@]}"; do
    if ! iptables -C $rule 2> /dev/null; then
        echo "Adding rule \"$rule\""
        iptables -A $rule
    fi
done
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.