1

I have one server where iptables configured with all chains DROP in filter table 

eth0 :- 10.0.0.2 [ Intranet assume as LAN ]
eth2 :- 172.16.0.2 [ External clients assume as WAN ]

Now What I am trying to achieving is , when client[172.16.0.1] HIT Port 80 On 172.16.0.2 then it should be nat to internal LAN IP that is 10.0.0.100.

What I have configured to achieve the same [INPUT,OUTPUT,FORWARD Policy is Drop in Filter Chains]

iptables  -A INPUT -s 172.16.0.1/32 -d 172.16.0.2/32 -i eth2 -p tcp -m tcp --dport 80 -j ACCEPT
iptables  -A FORWARD -s 172.16.0.1/32 -j LOG --log-prefix "** TRACING FORWARD CHAIN **" 
iptables  -A FORWARD -s 172.16.0.1/32 -d 10.0.0.100/32 -i eth2 -o eth0 -j ACCEPT
iptables  -A OUTPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
iptables  -t nat -A PREROUTING -s 172.16.0.1/32 -d 172.16.0.2/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0.100:80

net.ipv4.ip_forward = 1 in sysctl.conf

In Logs:

[17385.347409] ** TRACING FORWARD CHAIN **IN=eth2 OUT=eth0 MAC=xxxxxxxx SRC=172.16.0.1 DST=10.0.0.100 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=9864 DF PROTO=TCP SPT=52874 DPT=80 WINDOW=8192 RES=0x00 SYN URGP=0

Now When I Set FORWARD POLICY ACCEPT then it is working but not working with Forward Drop Policy.

So can anyone help me to understand forward policy and which rules should be added in forward policy.

2
  • In the description I read "eth0, eth1", in the code I read "eth2"...
    – Hauke Laging
    Feb 24, 2013 at 18:15
  • Opss, that was mistake now it is corrected
    – Rahul Patil
    Feb 24, 2013 at 18:29

1 Answer 1

Reset to default
1

This does not really make sense:

iptables  -A OUTPUT -p tcp -m state --state ESTABLISHED -j ACCEPT

should be

iptables  -A FORWARD -m state --state ESTABLISHED -j ACCEPT

and should be the first FORWARD rule. The logging should probably be limited to new connections:

iptables  -A FORWARD -s 172.16.0.1/32 -m conntrack --ctstate NEW -j LOG --log-prefix "** TRACING FORWARD CHAIN **"

Edit 1

In case this system is not the gateway for 10.0.0.100 (the default gateway or at least the gateway for 172.16.0.0) you also need SNAT:

iptables -t nat -A POSTROUTING -s 172.16.0.1/32 -d 10.0.0.100 -j SNAT --to-source 10.0.0.x # the eth0 IP

Use tcpdump to check what packets leave the system via eth0 and which come back.

6
  • can you tell whey OUTPUT EST not required ??
    – Rahul Patil
    Feb 24, 2013 at 18:26
  • it's not working..
    – Rahul Patil
    Feb 24, 2013 at 18:28
  • @RahulPatil answer edited
    – Hauke Laging
    Feb 24, 2013 at 20:56
  • @RahulPatil The OUTPUT chain works on packets which have been created on the system. Read a tutorial about Netfilter basics. If you would open 10.0.0.100 in a browser that runs on this system then the packets created by the browser process would enter the OUTPUT chain. It is completely irrelevant to forwarding. So is INPUT BTW. Your input rule is useless (never matches).
    – Hauke Laging
    Feb 24, 2013 at 23:33
  • My Output Chain is Drop that's why i have added rule in that. it's not unless
    – Rahul Patil
    Feb 25, 2013 at 2:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .