Networking :: Iptables - Forwarding On Router Doesn't Appear To Be Working

Sep 12, 2009

For the background, I'll be using my router as a firewall with snort-inline enabled. I got 3 NIC's: one for the WAN, the second will be bridged to the WAN NIC for queuing traffic which snort-inline requires, and the third is the LAN NIC (the computer I use for everyday work). Here's how I have my interfaces set up:

Code:

# /etc/network/interfaces
# Loopback interface
auto lo
iface lo inet loopback

[code]....

From what I understand, queuing needs to be set up on the bridge. From the documentation I've read it's done like this:

Code:

iptables -A INPUT -j QUEUE
And then to forward traffic, I did:

Code:

iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE

I've done this and am able to ping the router, obtain a DNS address from dnsmasq from the LAN computer. From the router I am able to connect to the internet (ping, links <address>...). From the LAN computer trafficking isn't getting forwarded, Firefox, links, ping all don't resolve.

View 7 Replies


ADVERTISEMENT

Networking :: Iptables Port Forwarding Not Working?

Jan 28, 2011

I've used iptables since it replace ipchains, and I've never had a problem like this.The problem is, as you can see by the title, that port forwarding simply does not work.

network topology:
Slackware Linux Server:
eth0 - LAN (192.168.0.0/25)
eth1 - DSL Static IP
eth2 - cable Static IP

eth1 is our standard office connection; it handles all of our default traffic (web browsing for the staff, email, etc). eth2 is our VPN connection, as well as use for all incoming connections (www, etc). Behind the linux box I have a series of Windows Server 2008 R2 boxes that are used to run our office software, website, etc - I don't care how nice they make their products these days, I simply don't trust any MS box open to the net.
Therefore, this leaves me with having to port forward port 80 from eth2 to the internal IP address of the web server.

My ruleset is as follows:

$WWW - ip address of the web server
iptables -A FORWARD -d $WWW -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 80 -j DNAT --to $WWW

Running ip route shows that I have routing entries for all 3 networks, and I can ping, ssh, etc to any of the addresses without issue. OpenVPN connects across eth2 as well, and all 15 of my VPN tunnels work fine. However - and here's the kicker - if I delete the default route and replace it with the route for eth2, port forwarding works fine.

If we accept that my networks are as follows:

192.168.0.0/25 - eth0 net, gw .1
1.1.1.0/29 - eth1 net, gw .1, eth1 ip .2
2.2.2.0/30 - eth2 net, gw .1, eth2 ip .2

then ip route reveals the following:

2.2.2.0 via 2.2.2.1 dev eth2
2.2.2.0 dev eth2 scope link src 2.2.2.2
1.1.1.0 dev eth1 scope link src 1.1.1.2

[code]....

View 7 Replies View Related

Networking :: IPTables Port Forwarding Using Prerouting Not Working?

Feb 18, 2010

I was trying to setup port forwarding on my setup. My network consists of:

Code:

[Server: xxx.xxx.xxx.15]
|
|
[ switch ]

[code]....

I ran the following 2 commands:

# iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j DNAT --to-destination xxx.xxx.xxx.15:80
# iptables -A INPUT -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT

Yet I am unable to connect. Are these the correct commands? I am using IP Masquedering on the same box using the following commands:

Code:

$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT

[code]....

I don't think there is a hidden firewall in the switch but if these commands are correct, then I may need to contact my ISP and see if they are blocking the commands. I just wanted to make sure I was not doing some stupid mistake before I try to contact my ISP.

EDIT: Also, is it possible to forward Port 80 requests to different servers depending on the hostname used to connect, so say [URL] redirects to server xxx.xxx.xxx.15 while hhh.com redirects to xxx.xxx.xxx.16?

View 3 Replies View Related

Red Hat / Fedora :: Iptables And Forwarding Stuff Doesn't Work On The Private Network

Mar 27, 2011

I have 2 different networks: the first one is gateway machine (eth0), and the second is a private machine (eth1). So, I've configured the iptables and forwarding stuff and when I try to ping google.com on the gateway machine, it works, while it doesn't work on the private network. Note: I am using VmWare 7. I need your quick assistance about this issue.

View 2 Replies View Related

Server :: Iptables Port Forwarding Not Working?

Mar 26, 2010

I have the following setup and Im trying to forward all incoming connection on port 1194 on eth2 which is the external network to ip 192.168.10.100, but seems its not working.

Current config:

# Generated by iptables-save v1.3.8 on Sun Nov 16 00:00:54 2008
*nat
:PREROUTING ACCEPT [26751696:2175544875]
:POSTROUTING ACCEPT [339911:19096812]

[code]....

plus im adding the prerouting:

iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 1194 -j DNAT --to-destination 192.168.10.100

This configuration doesnt work. I also I have tried:

iptables -D PREROUTING -t nat -p tcp -d XX.XX.XX.XX --dport 1194 -m state --state NEW,ESTABLISHED,RELATED -j DNAT --to 192.168.10.100:1194

and the same its not working. Connecting thru telnet to the domain: telnet mydomain.org 1194 doesnt work, but within the server, running telnet 192.168.10.100 1194 it works.

View 8 Replies View Related

Ubuntu :: Port Forwarding Using Iptables Not Working?

Jul 17, 2009

I am using ubuntu 8.40 as a router wit 2 nic.eth0 is for local and eth1 is for external network.i have a internal webserver in my lan and want to forward some ports to the net and i executed te following commands.

iptables -t nat -A PREROUTING -p tcp -i eth1 -d 192.168.0.239 --dport 8080 -j DNAT --to 192.168.10.99:8080
iptables -A FORWARD -p tcp -i eth1 -d 192.168.10.99 --dport 8080 -j ACCEPT

But i cant connect to the port 8080 from the external network.

View 11 Replies View Related

Networking :: Iptables Not Forwarding To Another Ip?

Dec 13, 2010

I have 2 Linux boxes one acting as a router with a direct connection to the internet, second as a server using the first box as a gateway to the internet. I need to forward requests that I get from the outside to port 8400 to my internal server box at 192.168.0.7:8400

Router IP 192.168.0.5
Server IP 192.168.0.7
iptables -t nat -A PREROUTING -p tcp -d [internet ip] --dport 8400 -j DNAT

[code]...

These rules are on the router (192.168.0.5) I've been trying to find a solution for hours with no success. Basically the problem is I can forward ports on the same box but not to a different ip.

View 1 Replies View Related

Networking :: Iptables Not Port Forwarding?

Aug 14, 2010

I have a CentOS box which is Internet Facing. It has 3 LAN's connected to it which are for virtual machines.

I want to port forward port 445 to a machine on one of the LAN interfaces. I have tried various ways to get it done, but still cannot access that port from the interface. I definately know device hosting port 445 is live, as I can ping it from the CentOS box and use lynx to access it! (It's a web server)

iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 445 -j DNAT --to-destination 192.168.0.2:445

View 6 Replies View Related

Networking :: Iptables Port Forwarding?

Jun 7, 2010

I've been Googling about port forwarding iptables and even though there's result and I've applied it in my script, I can't make iptables forwading request to another machine so I decided to ask help.

eth0 is my Internet Interface (1.2.3.4 is the public ip)
eth1 is my Lan Interface
eth2 is my DMZ Interface

[code]....

View 14 Replies View Related

Networking :: Packet Forwarding Using IPtables?

May 4, 2011

I have 2 Ubuntu boxes sitting in the same subnet; server 1 [130.15.6.68] and server 2 [130.15.6.69] What I am trying to achieve here is the following: server 1 act as a gateway or proxy to server 2, meaning that server 1 is exposed to the Internet and all traffic to server 2 should go though it (i hope!).

server 2 act as application server and I don't want a direct access to it from the internet. I want all the inbound traffic comes through server 1. for testing purposes, i will limit the traffic to simple http or port 80

in server 1, i have done the following settings: iptables -t nat -A PREROUTING -p tcp -i eth0 -d 130.15.6.68 --dport 80 -j DNAT --to 130.15.6.69:80 iptables -A FORWARD -p tcp -i eth0 -d 130.15.6.69 --dport 80 -j ACCEPT In server 1, I've edited the value of net.ipv4.ip_forward to equal 1 (uncomment that line in /etc/sysctl.conf) Currently, both server 1 and server 2 has its own apache2 servers with different index.html files. the problem is, when i browse to server 1, I am still seeing its index page rather than being forwarded to the index page of server 2. how can i achieve the traffic forwarding from server 1 to server 2 when my browser pointing to server 1?

View 3 Replies View Related

Networking :: Port Forwarding With IPTables?

May 6, 2011

I have a server running debian squeeze and kvm to virtualize a Windoze box. It's setup to use NAT. This is because of limits on the network by the admin and unfortunately, there isn't a way to get around this.

View 1 Replies View Related

Networking :: Forwarding Ports With Iptables?

Dec 23, 2010

I am running a server with ssh and a vpn server set up. It is behind a debian router with a firewall which uses iptables. i have it set up to forward ports 22 and 443 to ssh on a computer within the LAN(so when on a restricted network i can still ssh into my network) and forward anything to 1723(for my vpn) to that box also. However, the only port that gets successfully forwarded is port 22. The other two appear closed. here is what the script looks like:

Code:
#!/bin/sh
#

[code]...

View 2 Replies View Related

Networking :: IPTables Port Forwarding To Routed IP?

Aug 3, 2010

I have a linux server I'm intending to use as a firewall. The server has the following adapters

eth0 - Public IP (VLAN2)
eth0:1 - Public IP2 (VLAN2)
eth1 - 10.241.4.4 (VLAN4)

the Default gateway is my ISPs gateway. Additionally, I have the following route set: route add -net 10.0.0.0 netmask 255.0.0.0 gw 10.241.4.1

I have a server that exists on VLAN 208 at IP 10.241.209.67/21., its GW is 10.241.208.1 (first IP in /21 range)

as it is on the 10.0.0.0/8 network, traffic from the firewall is successfully routed from that server through my router to the FW and out to the Internet. The FW can ping, ssh, etc... the server and vice versa.

I want an iptables rule that will allow me to forward port 4401 on eth0:1 to 10.241.209.67:4401.

Is this possible since the IP is not on the same subnet as eth1, even though it is accessible?

I'm a bit better than a neophyte linux user. I have not made port forwards with it in the past without scripts to assist so I'm looking for not just "it is possible", but also the syntax of how to add it.

View 2 Replies View Related

Networking :: Port Forwarding In Router For Wol?

Mar 4, 2009

I have the wake on lan option enabled on my debian computer. If i wake it by sending:

-mac adres
-internal ip in my home network
-subnetmask
-port 7

It all works fine, but when i try to do it from outside my network and change the ip address to the router adress it wont go on. I have also opened the port 7 in my router.

View 6 Replies View Related

Ubuntu Networking :: Port Forwarding With Arno Iptables?

Feb 20, 2010

iam using arno iptables can give me command to ip forwarding cause my web server behind my router. my ip web server 192.168.0.11 and my ip router on eth 1 192.168.0.1 and eth0 i use to dial up my modem and i use pppoe for that.

View 2 Replies View Related

Ubuntu Networking :: Iptables And Cannot Get Port Forwarding To Work?

Mar 8, 2011

I've been beating myself over the head with iptables and CANNOT get port forwarding to work. Here's my situation: Static LAN IP on eth0 Static internet IP on eth1 ip_forward is turned on by uncommenting in sysctl.conf Here's the output of iptables-save:

Code:
# Generated by iptables-save v1.4.4 on Tue Mar 8 10:34:12 2011
*nat
:PREROUTING ACCEPT [2443:347058]

[Code]...

Edit: by the way, the intended purpose of this machine is to server as a gateway and firewall. MASQUERADE is working, for whatever that is worth. And the host behind the firewall that is serving up http is definitely working too. All that is not working is getting hosts on the internet talking to hosts behind the firewall.

View 1 Replies View Related

Ubuntu Networking :: Router Port Forwarding For Ssh

Aug 22, 2010

I have logged into my router and set up port-forwarding on port 22. I can log into the machine fine from a machine on the local network using the machines internal IP but when I try to log on from a remote machine using my router's external IP or my DyDNS host-name I get a message saying "connection refused" or "connection timed out." I have configured port-forwarding on the router and the firewall rules says that port 22 is open but when I nmap my routers external ip it says that only port 23 and 80 are open. I am very new to linux and networking.

View 8 Replies View Related

Networking :: IPTables Rules On PPPOE Connection - Forwarding / Routing

Sep 23, 2010

I'm trying to configure Iptables and I just want to block everything but http/https. However, my connection is pppoe, so I have the ppp0 interface. Pretty much every Iptables tutorial that I found don't teach how to deal with this kind of setup. I'm forwarding the ppp0 to eth0 and I could configure the input rules and they're working. After this, I need to configure the output but nothing seems to work.

The current working rules are:
Code:
Chain INPUT (policy ACCEPT 7858 packets, 5792K bytes)
pkts bytes target prot opt in out source destination
299 201K ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
11 820 DROP all -- any any anywhere anywhere

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- eth0 ppp0 anywhere anywhere
0 0 ACCEPT all -- ppp0 eth0 anywhere anywhere state RELATED,ESTABLISHED
Chain OUTPUT (policy ACCEPT 10791 packets, 1951K bytes)
pkts bytes target prot opt in out source destination

I don't understand what those "state RELATED,ESTABLISHED" rules do. Also, I don't know if this rules are secure, because i'm very confused about the ppp0/eth0 interfaces.

View 1 Replies View Related

Ubuntu Networking :: SSH Server And Router Port Forwarding

Aug 29, 2010

I'm trying to get my SSH server I set up on my home box working from behind a router. A 2wire 2700HG-B gateway, in fact. Now, I know my server is working fine, because I can get into it via loopback, anywhere inside the LAN from another machine, OR if I go into the router's config and enable DMZ for the machine. However, I don't like having DMZ on all the time because of the kludge-ness of it, and the security issue of the complete absence of a hardware firewall.If I try to port forward and access it from outside the LAN using the external IP (or my DynDNS, because it's dynamic), it just times out. I have a nonstandard port (45) for the listen port of the server, to keep away hack attempts if I were using the standard 22. I used this to see if the port was open, and it said it was. But, I tried the trick of telnetting the IP with that port, and it also timed out, instead of printing stuff about OpenSSH.

Attached is a screenie of my router's firewall page, so you all can look at it and see if I'm an idiot and doing it wrong. You might notice uTorrent there, it's because this machine is a dual-boot with 7, and the router doesn't differentiate the OS's. Also the SSH @ 46 port is for the Windows side, with freeSSHd. I changed the port on that one so the client I have can distinguish them, so it can run a reachability test.

View 9 Replies View Related

Networking :: IPtables Port Forwarding \ Have A Computer With Two Interfaces Eth0(LAN) And Eth1(WAN)?

Apr 20, 2011

I have a computer with two interfaces eth0(LAN) and eth1(WAN).I have followed some guides on the internet and came up with this iptables configuration:

# Generated by iptables-save v1.4.4 on Wed Apr 20 09:43:12 2011
*nat
:OUTPUT ACCEPT [0:0]

[code].....

View 2 Replies View Related

Ubuntu Networking :: Router : No Connection After Modifying Port Forwarding Settings

Sep 2, 2010

what I have: Belkin G Wireless Router Model F5D7234-4. To attempt to get Subsonic working, I changed the port forwarding settings (Belkin calls it Virtual Servers) to forward port 4040 to my desktop computer. I then saved changes, and my wireless disconnected. I waited about 3 minutes, and nothing was happening, so I restarted my router. This left me in the position that I am in now. Even when the router and modem are fully booted, the router does not broadcast my SSID. In addition, a wired connection will not connect to the network through the router. This leaves me completely unable to use wireless, and unable to change any settings in the router.

View 3 Replies View Related

Networking :: Port Forwarding - Router - Ssh Requests Time Out - Tomato Firmware

May 18, 2010

I've managed to confirm that I can reach my home network via ssh from a remote location through my SMC Barricade when it is directly connected to the desktop machine but when the second router is put back into the chain ssh requests time out. The second router is a Linksys WRT 54GL running the Tomato firmware. The chain looks like this: ISP's router (bridged) --> Barricade -->WRT54GL-->desktop

The Barricade has port 22 forwarded to the Linksys' WAN address and it in turn forwards to the desktop address. It appears that it is a setting on the Linksys firmware that is preventing the remote connection. I've looked through the various settings many times but cannot see anything that would cause the problem.

View 4 Replies View Related

Networking :: Ip Forwarding Doesn't Work?

Feb 15, 2011

I have 2 guest machines on 1 VBox host installed : - one guest with hostname 'debian' is configured as follows and has IP Forwarding enabled to be able to route traffic from eht1 to eth0.

Code:
eth0 Link encap:Ethernet HWaddr 08:00:27:f1:ef:5f
inet addr:10.0.2.1 Bcast:10.0.2.255 Mask:255.255.255.0
inet6 addr: fe80::a00:27ff:fef1:ef5f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

[Code]....

View 2 Replies View Related

Networking :: IP Forwarding /NAT Doesn't Work After System Update?

Oct 22, 2009

I used the following 2 rules in iptables to forwarding some packagesiptables -t nat -A PREROUTING -p tcp --dport 8000 -j DNAT --to-destination 192.168.0.244:8000iptables -t nat -A POSTROUTING -p tcp --dport 8000 -j MASQUERADEIt works perfectly before, the kernel was 2.6.18-92.1.22.el5.After we did a update, the kernel now is 2.6.18-128.7.1.el5.and the forwarding is stop.I just wondering where can I get some debug information. I checked /var/log/message, dmesg ... seems nothing there.

View 1 Replies View Related

Networking :: Iptables - Port Forwarding To Blocked Port?

Mar 25, 2010

I have a mail server on which I would like to block port 25 on my eth0 for everyone except our external spam filter. the problem is that I want our users to be able to connect via port 10025 which is forwarded to port 25, which then is blocked...

View 2 Replies View Related

Networking :: X Forwarding Through SSH Not Working: $DISPLAY Not Set

May 7, 2011

I am trying to redirect my display from a debian box that I ssh into to my laptop. I connect using

Code:
$ssh -vv -XC remote.host
and in the debug messages all I get about X is this

Code:
debug1: Requesting X11 forwarding with authentication spoofing.
Once I'm connected, X forwarding does not work. For example, when I try and start, say, xcalc, I get

Code:
$xcalc &
Error: Can't open display:

It seems that the problem is the $DISPLAY variable is not set on the remote machine (echo $DISPLAY doesn't return anything), but from what I read, sshd is responsible for setting this variable, as long as "X11Forwarding yes" is uncommented in the /etc/ssh/sshd_config file (which I made sure is true). Is there any other reason why sshd won't open a display on the remote host?

View 5 Replies View Related

CentOS 5 Networking :: IP Forwarding Is Not Working

Apr 1, 2009

I'm trying to set up my CentOS 5 box as a gateway for my home network.I've set up dhcp on my internet interface (eth0) and dhcpd on my LAN interface (eth1).I can browse the internet from my CentOS 5 box.I can ping the CentOS 5 box from my LAN.However, I can't browse the internet from my LAN.I've enabled IP forwarding in /etc/sysctl.conf and I've disabled my firewall. I've saved these changes and rebooted. Again, no internet browsing from my LAN.

View 2 Replies View Related

Fedora Networking :: Port Forwarding Not Working?

Apr 23, 2009

I am running Fedora Core 10 and KDE 4.2.1. My KTorrent is having trouble finding online peers lately. I suspect this is a port forwarding issue. I have set up my router to forward port 4444 (UDP) and port 56000 and more (TCP) to my machine's IP address. I have also set my local firewall (system-config-firewall) to allow these ports through.But when I try to test ports 4444 and 56000 via this Open Port Check Tool, it tells me they are closed

View 6 Replies View Related

Networking :: IP Forwarding Not Working On Centos Server

Jan 18, 2010

I am setting up a new server with 2 nics installed. Nic0 goes to the firewall and nic1 goes to the internal engineering network.

Problem is Ip forwarding is not working!

Particulars:
Server Name - slick
Firewall Name - gateone
engineering node - crooked

Routing on slick:

From crooked ( which is inside the server (slick) with an ip address of xx.xx.221.249 the only way I can ping or anything outside of the firewall ( gateone) is to turn on IPtables with this configuration:

I don't want to use IPtables. I need the ip forwarding to work.

View 6 Replies View Related

Slackware :: Port Forwarding Using IPtables?

Jun 16, 2011

how to set an external static IP address to forward to an internal static IP address. Here is an example:

Linux box (slackware) IP address =
eth0: 10.xxx.xxx.xxx (internal)
eth1: xxx.xxx.xxx.170
eth1.0: xxx.xxx.xxx.171
eth1.1: xxx.xxx.xxx.172

DVR system that I need to forward to: IP address =
xxx.xxx.xxx.251
xxx.xxx.xxx.252

This was all setup by someone else whom I have never spoken with. The IP tables seems to be set up but I cannot provide a screen shot at this time. What I need to do is this. When a user connects to the external static IP address of xxx.xxx.xxx.171 with their DVR software, IP tables will forward to the DVR system at xxx.xxx.xxx.251. The ports desired are 554,555,556, and 557. I know some about Linux but not about IPtables.

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved