[ale] port forwarding for iptables.
Atlanta Geek
atlantageek at gmail.com
Tue Jun 9 13:39:51 EDT 2009
I am redirecting to a different port and the ip of another machine.
Does REDIRECT allow me to specify a different machine's ip?
On Tue, Jun 9, 2009 at 1:31 PM, Jim Kinney<jim.kinney at gmail.com> wrote:
> all of the -j LOG calls will never trigger because the packet has
> already left the chain due to the line before it with the -j ACCEPT or
> -j DNAT. Put the log before the jump call.
>
> -j REDIRECT is what you want to use. DNAT is for IP address. REDIRECT
> is for port forwarding.
>
> On Tue, Jun 9, 2009 at 1:16 PM, Atlanta Geek<atlantageek at gmail.com> wrote:
>> OK. so I am trying to use portforwarding with iptables
>>
>> here is the output from 'lsmod | grep iptable' , iptables-save and
>> iptables --list
>>
>> any suggestions would be great
>> The only thing that is a little weird with this is that I am
>> forwarding ports within the same network. So maybe the -DNAT is
>> screwing things up?
>>
>> *************OUTPUT of lsmod
>> [root at krobinson sysconfig]# lsmod | grep iptable
>> iptable_filter 36161 1
>> iptable_nat 40773 1
>> ip_nat 53100 1 iptable_nat
>> ip_conntrack 91236 5
>> ip_conntrack_ftp,ip_conntrack_netbios_ns,xt_state,iptable_nat,ip_nat
>> ip_tables 55329 2 iptable_filter,iptable_nat
>> x_tables 50377 8
>> ipt_LOG,xt_state,iptable_nat,ip_tables,ip6_tables,ipt_REJECT,ip6t_REJECT,xt_tcpudp
>>
>> **********OUTPUT of 'iptables-save' START
>> nat
>> :PREROUTING ACCEPT [55:9852]
>> :POSTROUTING ACCEPT [74:4440]
>> :OUTPUT ACCEPT [74:4440]
>> -A PREROUTING -d 10.0.0.39 -i eth0 -p tcp -m tcp --dport 5213 -j DNAT
>> --to-destination 10.0.1.213:3001
>> -A PREROUTING -d 10.0.0.39 -i eth0 -p tcp -m tcp --dport 5213 -j LOG
>> --log-prefix "TCP PREROUTING:"
>>
>> COMMIT
>> # Completed on Wed Jun 10 00:11:38 2009
>> # Generated by iptables-save v1.3.5 on Wed Jun 10 00:11:38 2009
>> *filter
>> :INPUT ACCEPT [0:0]
>> :FORWARD ACCEPT [0:0]
>> :OUTPUT ACCEPT [3459:642904]
>> :RH-Firewall-1-INPUT - [0:0]
>> -A INPUT -j RH-Firewall-1-INPUT
>> -A FORWARD -j RH-Firewall-1-INPUT
>> -A FORWARD -d 10.0.1.213 -i eth0 -p tcp -m tcp --dport 3001 -j ACCEPT
>> -A FORWARD -d 10.0.1.213 -i eth0 -p tcp -m tcp --dport 3001 -j LOG
>> --log-prefix "TCP FORWARD:"
>> -A RH-Firewall-1-INPUT -i lo -j ACCEPT
>> -A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
>> -A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
>> -A RH-Firewall-1-INPUT -p esp -j ACCEPT
>> -A RH-Firewall-1-INPUT -p ah -j ACCEPT
>> -A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
>> -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
>> -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
>> -A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
>> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 3001 -j ACCEPT
>> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 5000 -j ACCEPT
>> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
>> -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
>> COMMIT
>> # Completed on Wed Jun 10 00:11:38 2009
>> ***************OUTPUT END
>> But it does not seem to be working. The output from my iptables -l
>> looks like the following
>>
>> *********OUTPUT 'iptables --list' START
>> [root at krobinson sysconfig]# iptables --list
>> Chain INPUT (policy ACCEPT)
>> target prot opt source destination
>> RH-Firewall-1-INPUT all -- anywhere anywhere
>>
>> Chain FORWARD (policy ACCEPT)
>> target prot opt source destination
>> RH-Firewall-1-INPUT all -- anywhere anywhere
>> ACCEPT tcp -- anywhere lab-at2503 tcp
>> dpt:redwood-broker
>> LOG tcp -- anywhere lab-at2503 tcp
>> dpt:redwood-broker LOG level warning prefix `TCP FORWARD:'
>>
>> Chain OUTPUT (policy ACCEPT)
>> target prot opt source destination
>>
>> Chain RH-Firewall-1-INPUT (2 references)
>> target prot opt source destination
>> ACCEPT all -- anywhere anywhere
>> ACCEPT all -- anywhere anywhere
>> ACCEPT icmp -- anywhere anywhere icmp any
>> ACCEPT esp -- anywhere anywhere
>> ACCEPT ah -- anywhere anywhere
>> ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
>> ACCEPT udp -- anywhere anywhere udp dpt:ipp
>> ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
>> ACCEPT all -- anywhere anywhere state
>> RELATED,ESTABLISHED
>> ACCEPT tcp -- anywhere anywhere state NEW
>> tcp dpt:redwood-broker
>> ACCEPT tcp -- anywhere anywhere state NEW
>> tcp dpt:commplex-main
>> ACCEPT tcp -- anywhere anywhere state NEW
>> tcp dpt:http
>> REJECT all -- anywhere anywhere
>> reject-with icmp-host-prohibited
>> **********OUTPUT END
>> --
>> http://www.atlantageek.com
>> _______________________________________________
>> Ale mailing list
>> Ale at ale.org
>> http://mail.ale.org/mailman/listinfo/ale
>>
>
>
>
> --
> --
> James P. Kinney III
> Actively in pursuit of Life, Liberty and Happiness
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
>
--
http://www.atlantageek.com
More information about the Ale
mailing list