topic Re: port forwarding with iptables in Operating System - Linux

port forwarding with iptables

boooo radly — Wed, 25 Sep 2002 14:18:51 GMT

i have setup linux box with redhat 7.2 as a router. it has 2 nics, eth1 is the net nic and eth0 is the lan nic.
im running an ftp on a machine on the lan but i also want it to be available through the net. so i just want to forward the port from the router to the internal machine. and i havent been able to get an iptables rule(s) setup to do it. i also chose to accept connections be default and only drop those connections to specific ports that i choose, rather than close everything and only open those that i chose....
heres what i tried

iptables -t nat -A PREROUTING -p tcp --dport 21 -j DNAT --to-dest 192.168.1.10:21
iptables -A FORWARD -p tcp -i eth1 --dport 21 -d 192.168.1.10 -j ACCEPT

i dont think i should need the second line since i have chosen to accept all connections except those speicified, but i figured it was worth a shot anyway...

anyone have any ideas?

Re: port forwarding with iptables

benoit Bruckert — Thu, 26 Sep 2002 08:53:35 GMT

Hi,
ftp is a specific protocol, because it's storing in the datas during connection the port on each side to established data tranfer.
the ftp-data (port 20) is also used !!
There's a passive mode which permit to avoid the port in data described bellow.
THe best thing is to authorize to go outside any ports gt 1024, and inside the port 20.
If you need ftp from both side, then you will have to open much more other ports.....
See your deny tcp packets from the log to see all what is needed when you try an ftp session...

hope it will help
Benoit

Re: port forwarding with iptables

boooo radly — Thu, 26 Sep 2002 16:12:34 GMT

where would i find the logs for my tcp connections? i looked and couldnt find anything....but im not exactly sure what file(s) im looking for...

thanks for the help

Re: port forwarding with iptables

Mark Fenton — Fri, 27 Sep 2002 23:42:15 GMT

boooo, (kinda cool moniker...)

the log in question would be

/var/log/messages

unless you've set up your iptables to log elsewhere.

It might be instructive to run a packet sniffer (like ethereal) to watch what happens on the interfaces when ftp connections are attempted.

Best Regards,
Mark