[ale] port forwarding for iptables.

[Jim Kinney]

all of the -j LOG calls will never trigger because the packet has
already left the chain due to the line before it with the -j ACCEPT or
-j DNAT. Put the log before the jump call.

-j REDIRECT is what you want to use. DNAT is for IP address. REDIRECT
is for port forwarding.

On Tue, Jun 9, 2009 at 1:16 PM, Atlanta Geek<atlantageek at gmail.com> wrote:
> OK. so I am trying to use portforwarding with iptables
>
> here is the output from  'lsmod | grep iptable' , iptables-save and
> iptables --list
>
> any suggestions would be great
> The only thing that is a little weird with this is that I am
> forwarding ports within the same network.  So maybe the -DNAT is
> screwing things up?
>
> *************OUTPUT of lsmod
> [root at krobinson sysconfig]# lsmod | grep iptable
> iptable_filter         36161  1
> iptable_nat            40773  1
> ip_nat                 53100  1 iptable_nat
> ip_conntrack           91236  5
> ip_conntrack_ftp,ip_conntrack_netbios_ns,xt_state,iptable_nat,ip_nat
> ip_tables              55329  2 iptable_filter,iptable_nat
> x_tables               50377  8
> ipt_LOG,xt_state,iptable_nat,ip_tables,ip6_tables,ipt_REJECT,ip6t_REJECT,xt_tcpudp
>
> **********OUTPUT  of 'iptables-save' START
> nat
> :PREROUTING ACCEPT [55:9852]
> :POSTROUTING ACCEPT [74:4440]
> :OUTPUT ACCEPT [74:4440]
> -A PREROUTING -d 10.0.0.39 -i eth0 -p tcp -m tcp --dport 5213 -j DNAT
> --to-destination 10.0.1.213:3001
> -A PREROUTING -d 10.0.0.39 -i eth0 -p tcp -m tcp --dport 5213 -j  LOG
> --log-prefix "TCP PREROUTING:"
>
> COMMIT
> # Completed on Wed Jun 10 00:11:38 2009
> # Generated by iptables-save v1.3.5 on Wed Jun 10 00:11:38 2009
> *filter
> :INPUT ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [3459:642904]
> :RH-Firewall-1-INPUT - [0:0]
> -A INPUT -j RH-Firewall-1-INPUT
> -A FORWARD -j RH-Firewall-1-INPUT
> -A FORWARD -d 10.0.1.213 -i eth0 -p tcp -m tcp --dport 3001 -j ACCEPT
> -A FORWARD -d 10.0.1.213 -i eth0 -p tcp -m tcp --dport 3001 -j LOG
> --log-prefix "TCP FORWARD:"
> -A RH-Firewall-1-INPUT -i lo -j ACCEPT
> -A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
> -A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
> -A RH-Firewall-1-INPUT -p esp -j ACCEPT
> -A RH-Firewall-1-INPUT -p ah -j ACCEPT
> -A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
> -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
> -A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 3001 -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 5000 -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
> -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
> COMMIT
> # Completed on Wed Jun 10 00:11:38 2009
> ***************OUTPUT END
> But it does not seem to be working.  The output from my iptables -l
> looks like the following
>
> *********OUTPUT 'iptables --list'  START
> [root at krobinson sysconfig]# iptables --list
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination
> RH-Firewall-1-INPUT  all  --  anywhere             anywhere
>
> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination
> RH-Firewall-1-INPUT  all  --  anywhere             anywhere
> ACCEPT     tcp  --  anywhere             lab-at2503          tcp
> dpt:redwood-broker
> LOG        tcp  --  anywhere             lab-at2503          tcp
> dpt:redwood-broker LOG level warning prefix `TCP FORWARD:'
>
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
>
> Chain RH-Firewall-1-INPUT (2 references)
> target     prot opt source               destination
> ACCEPT     all  --  anywhere             anywhere
> ACCEPT     all  --  anywhere             anywhere
> ACCEPT     icmp --  anywhere             anywhere            icmp any
> ACCEPT     esp  --  anywhere             anywhere
> ACCEPT     ah   --  anywhere             anywhere
> ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns
> ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
> ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
> ACCEPT     all  --  anywhere             anywhere            state
> RELATED,ESTABLISHED
> ACCEPT     tcp  --  anywhere             anywhere            state NEW
> tcp dpt:redwood-broker
> ACCEPT     tcp  --  anywhere             anywhere            state NEW
> tcp dpt:commplex-main
> ACCEPT     tcp  --  anywhere             anywhere            state NEW
> tcp dpt:http
> REJECT     all  --  anywhere             anywhere
> reject-with icmp-host-prohibited
> **********OUTPUT END
> --
> http://www.atlantageek.com
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
>



-- 
-- 
James P. Kinney III
Actively in pursuit of Life, Liberty and Happiness