topic Re: iptables in Operating System - Linux

iptables

U.SivaKumar_2 — Tue, 19 Nov 2002 07:48:14 GMT

Hi,

I have Redhat Linux 7.1 Kernel version 2.4.2-2.
with iptables v1.2.7 .

This nat module is loaded with ip_tables module
iptable_nat 16160 0 (autoclean) [ipt_MASQUERADE]

I'm trying to setup DNAT for port forwarding as per iptables documents . I have ip forwarding enabled. I want port forward from external interface to a internal server .

But the setup is not working , I have tried with all possible styles of PREROUTING chain.
When I connect to external IP address with the particular port , I get a "connection refused" error. But the software port forwarders work perfectly. I feel that the problem lies in proxy ARP support of the kernel.

Any suggestions ?

regards,
U.SivaKumar

Re: iptables

Admin32 — Tue, 19 Nov 2002 08:53:00 GMT

Hi there,

What port are you trying to forward and for what type of application ?

Reason I am asking is because depending on the application e.g ftp, you might need to forward additional ports, or slightly modify the iptables configuration to get this to work.

If you can provide more information on the setup and what your trying to do, then I might be able to help you more effectively :)

Cheers,

Chris P.
www.firewall.cx

Re: iptables

U.SivaKumar_2 — Tue, 19 Nov 2002 09:22:07 GMT

Hi,

Thanks for your response . The application is not FTP or IRC . I want to use ports 5050 5060

INTERNET---------|LINUX|------|INTERNAL SERVER|
xxx.xxx.xxx.xxx xx.xx.xx.xx

Anyone who connects to xxx.xxx.xxx.xxx external ip of the linux server at port 5050 5060 should be forwarded to xx.xx.xx.xx internal server's ports 5050 5060 . All ports are tcp based.

This is my iptables config file.

# Generated by iptables-save v1.2.7a on Tue Nov 19 14:49:40 2002
*filter
:INPUT ACCEPT [15251:2151220]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [588:54764]
-A FORWARD -d xx.xx.xx.xx -p tcp -m tcp --dport 5000 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 5000 -j ACCEPT
COMMIT
# Completed on Tue Nov 19 14:49:40 2002
# Generated by iptables-save v1.2.7a on Tue Nov 19 14:49:40 2002
*nat
:PREROUTING ACCEPT [9502:1572518]
:POSTROUTING ACCEPT [57:4168]
:OUTPUT ACCEPT [56:4124]
-A PREROUTING -d xxx.xxx.xxx.xxx -p tcp -m tcp --dport 5000 -j DNAT --to-destination
xx.xx.xx.xx
COMMIT
-A FORWARD -p tcp -m tcp --dport 5000 -j ACCEPT
COMMIT

regards,
U.SivaKumar

Re: iptables

U.SivaKumar_2 — Tue, 19 Nov 2002 11:52:25 GMT

Hi,
Problem solved . No need to reply

regards,
U.SivaKumar