topic iptables DNAT in Operating System - Linux

iptables DNAT

Sergejs Svitnevs — Mon, 23 Jan 2006 08:48:47 GMT

I have a multihomed linux 2.6 machine running iptables 1.2.11 which I use as my router.

There is my network configuration:
Test1 -(subnet_1)- eth0 Linux_Router_with_Nat eth2 -(subnet_2)- Cisco_Router -(subnet_3)- Test2

I wish to do DNAT on Linux Router so that any traffic arriving on the IP_from_subnet_2 are automatically redirected to the Test1.

I've added the following rule:
iptables -t nat -A PREROUTING -d -i eth2 -j DNAT --to-destination

I have a default policy of ACCEPT in my FORWARD and INPUT chains.

Now all packets from the subnet_2 are redirected to Test1.

But I have problem with subnet_3. Test1 does not receive any packets from this subnet.

"pkts" and "bytes" columns increasing in "iptables -L -n -v -t nat" output when I attempt to make connection to Test1 from Test2 but "forward" chain is empty; seems DNAT packets not getting to FORWARD chain.

Tell anyone tell me why I can not get this working from subnet_3?

Thanks in advance,
Sergejs

Re: iptables DNAT

Matti_Kurkela — Mon, 23 Jan 2006 09:45:51 GMT

Just checking: have you set
"sysctl net.ipv4.ip_forward" to 1? It is the master switch for all IP routing.

What's in your routing table?
Linux_Router's default gateway should be pointing towards the Cisco_Router or there should be a specific route on Linux_router to the subnet_3 through the Cisco_Router. Otherwise the rp_filter might drop the packets.

To test, set "sysctl net.ipv4.conf.all.rp_filter=0".

If you don't have the "sysctl" command, you can use "echo 1 >/proc/sys/net/ipv4/ip_forward" and "echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter".

Re: iptables DNAT

Sergejs Svitnevs — Mon, 23 Jan 2006 10:03:21 GMT

Matti,

IP forwarding is already enabled (I can forward packet from subnet_2 to subnet_1). It was not an issue.

I have added a new route to Linux router describing the way how to reach Test2 via cisco router:
# route add -net subnet_3 gw Cisco_router

and now DNAT works Ok.

Thanks a lot.

Re: iptables DNAT

Sergejs Svitnevs — Mon, 23 Jan 2006 10:05:18 GMT