IP forwarding with iptables help [SOLVED]

psycroptic · 2010-06-13 14:02:47

Hey. I posted a few months ago about setting up iptables so my linux box could replace my router. everything seems to be working fine, however i'm trying to forward TCP traffic on port 12345 to internal host 172.16.0.10/255.255.0.0 I've done everything i've read online as far as setting it up but the machine is still denying 12345 requests. (specifically it's for bitorrent, i randomly chose that port number).

Server/Firewall internal IP: 172.16.0.10 on eth1
External network (DHCP from comcast): eth0

I've posted my iptables config for the filter and the nat tables below:

Chain INPUT (policy DROP 17 packets, 584 bytes)
 pkts bytes target     prot opt in     out     source               destination
   28  3001 ACCEPT     all  --  lo     any     anywhere             anywhere
  747 59105 ACCEPT     all  --  eth1   any     anywhere             anywhere
   23  3140 DROP       all  --  any    any     anywhere             anywhere            state INVALID
  575  141K ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED
  565  144K OPEN-UDP   udp  --  any    any     anywhere             anywhere            state NEW
 4434  195K OPEN-TCP   tcp  --  any    any     anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN state NEW
    6   268 DROP       tcp  --  any    any     anywhere             anywhere            recent: SET name: TCP-PORTSCAN side: source
  219 28976 DROP       udp  --  any    any     anywhere             anywhere            recent: SET name: UDP-PORTSCAN side: source
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere            state NEW tcp dpt:12345

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 6086 3194K ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED
  375 25590 fw-interfaces  all  --  any    any     anywhere             anywhere
   31  1556 fw-open    all  --  any    any     anywhere             anywhere
    0     0 DROP       all  --  any    any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 77 packets, 15362 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OPEN-TCP (1 references)
 pkts bytes target     prot opt in     out     source               destination
 4428  195K DROP       tcp  --  any    any     anywhere             anywhere            recent: UPDATE seconds: 60 name: TCP-PORTSCAN side: source

Chain OPEN-UDP (1 references)
 pkts bytes target     prot opt in     out     source               destination
  346  115K DROP       udp  --  any    any     anywhere             anywhere            recent: UPDATE seconds: 60 name: UDP-PORTSCAN side: source

Chain fw-interfaces (1 references)
 pkts bytes target     prot opt in     out     source               destination
  344 24034 ACCEPT     all  --  eth1   any     anywhere             anywhere

Chain fw-open (1 references)
 pkts bytes target     prot opt in     out     source               destination
   27  1316 ACCEPT     tcp  --  any    any     anywhere             pLAN9-Wil.pLAN9.site tcp dpt:12345



Chain PREROUTING (policy ACCEPT 5419 packets, 376K bytes)
 pkts bytes target     prot opt in     out     source               destination
    6   328 DNAT       tcp  --  eth0   any     anywhere             anywhere            tcp dpt:12345 to:172.16.0.10

Chain POSTROUTING (policy ACCEPT 598 packets, 44008 bytes)
 pkts bytes target     prot opt in     out     source               destination
  270 17950 MASQUERADE  all  --  any    eth0    172.16.0.0/16        anywhere

Chain OUTPUT (policy ACCEPT 590 packets, 43560 bytes)
 pkts bytes target     prot opt in     out     source               destination

would anyone be able to help me on this? i'm still sort of learning linux networking myself. i could do this in my sleep on a windows box or a home router, but i think it's just something simple here i'm missing for this to work.

Last edited by psycroptic (2010-06-16 05:08:30)

Sin.citadel · 2010-06-13 17:35:03

you dnat rule seems to be working as seen by the packet count, it could be a mis-configured filter rule, try temporarily setting the default policy for forward/input table to accept and see if it works or not, if it doesnt, clean all the iptables rules and simply add the DNAT rule and see if it works.

psycroptic · 2010-06-14 03:27:26

i tried setting both FORWARD and INPUT chains to accept by default but it didn't work.

just curious, why would erasing all of the rules and then just adding the prerouting one solve this? is there not a way to avoid having to go through all of that setup again? i'd just rather not have to start from scratch, i'd like to know why it's not working....

jelly · 2010-06-14 09:58:01

Could you post your whole iptables config, . If i understand you correctly you want to forward a port from your internal network to the outside world.
-A PREROUTING -i eth0 -p tcp --dport 1234 -j DNAT --to 192.168.0.85:900
this opens port 9000 on 192.168.0.85 for the outside world

psycroptic · 2010-06-15 01:20:56

hmmm, running that command just gives me "iptables: No chain/target/match by that name."

what else about my config would i post? I've already given my filter and nat tables, what else is there? once again sorry, still somewhat dumb about this.

ill post my rules, if that helps at all:

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-N OPEN-TCP
-N OPEN-UDP
-N fw-interfaces
-N fw-open
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m state --state NEW -j OPEN-UDP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j OPEN-TCP
-A INPUT -p tcp -m recent --set --name TCP-PORTSCAN --rsource -j DROP
-A INPUT -p udp -m recent --set --name UDP-PORTSCAN --rsource -j DROP
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 12345 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j fw-interfaces
-A FORWARD -j fw-open
-A FORWARD -j DROP
-A OPEN-TCP -p tcp -m recent --update --seconds 60 --name TCP-PORTSCAN --rsource -j DROP
-A OPEN-UDP -p udp -m recent --update --seconds 60 --name UDP-PORTSCAN --rsource -j DROP
-A fw-interfaces -i eth1 -j ACCEPT
-A fw-open -d 172.16.0.10/32 -p tcp -m tcp --dport 12345 -j ACCEPT
-A fw-open -d 172.16.0.11/32 -p tcp -m tcp --dport 12346 -j ACCEPT

snakebite · 2010-06-15 16:01:28

jelly wrote:

Could you post your whole iptables config, . If i understand you correctly you want to forward a port from your internal network to the outside world.
-A PREROUTING -i eth0 -p tcp --dport 1234 -j DNAT --to 192.168.0.85:900
this opens port 9000 on 192.168.0.85 for the outside world

psycroptic wrote:

hmmm, running that command just gives me "iptables: No chain/target/match by that name."

PREROUTING doesn't exist in the "filter" table (the default) so you need to specify a table (raw, mangle or nat). You probably want the nat table, so add -t nat in front.

psycroptic · 2010-06-16 01:49:21

meh, adding "-t nat" made the command work, but i'm still not getting traffic.

i don't get it; why is this something that's so simple to do with basic linksys routers, yet so difficult with linux/iptables? aren't those routers basically tiny linux boxes anyway?

psycroptic · 2010-06-16 01:58:22

wait a second, this is really weird.....

i've been using the site "canyouseeme.org" to test that port forwarding is working. all this time i've been going to the site and it's been telling me the port was closed.

just now, for shits & giggles i opened up utorrent just to see if by some magical reason it would work. well guess what? i immediately started getting 2MB/s transfer speeds....

while utorrent was open i went back to canyouseeme.org & tested port 12345 - and it was open! so apparently, iptables only allows forwarded traffic in/out if there's an active service on that port?

am i reading this right? it's kind of a port triggering-type of deal?

fukawi2 · 2010-06-16 04:40:20

Just because you've forwarded the port, doesn't make it "open"

All iptables does when it blocks traffic is make it appear that there's no application listening for connections. So even if you "open" it in iptables, but don't start any application to listen, it still appears the same from the outside world.

(Yes, technically, you can make iptables respond with a different ICMP error code, but by default it just sends port-unreachable)

Edit: Spelling.

Last edited by fukawi2 (2010-06-16 04:40:56)

psycroptic · 2010-06-16 05:07:58

ok. that's kinda cool... so it sounds like it only opens itself when needed, correct?

fukawi2 · 2010-06-16 09:26:50

psycroptic wrote:

ok. that's kinda cool... so it sounds like it only opens itself when needed, correct?

Well the network stack of the O/S only opens it when an application requests it and "agrees" that it will handle any data received on that port. If there's no application to handle the data, then there's no point in the O/S accepting the data when there's no where to pass it through to

psycroptic · 2010-06-16 14:39:31

for sure, that makes sense. i just always kind of thought that port forwarding was just like opening/closing a door to the "outside world" as it were.

well that's pretty sweet all around. thanks for all the help folks!

Arch Linux

#1 2010-06-13 14:02:47

IP forwarding with iptables help [SOLVED]

#2 2010-06-13 17:35:03

Re: IP forwarding with iptables help [SOLVED]

#3 2010-06-14 03:27:26

Re: IP forwarding with iptables help [SOLVED]

#4 2010-06-14 09:58:01

Re: IP forwarding with iptables help [SOLVED]

#5 2010-06-15 01:20:56

Re: IP forwarding with iptables help [SOLVED]

#6 2010-06-15 16:01:28

Re: IP forwarding with iptables help [SOLVED]

#7 2010-06-16 01:49:21

Re: IP forwarding with iptables help [SOLVED]

#8 2010-06-16 01:58:22

Re: IP forwarding with iptables help [SOLVED]

#9 2010-06-16 04:40:20

Re: IP forwarding with iptables help [SOLVED]

#10 2010-06-16 05:07:58

Re: IP forwarding with iptables help [SOLVED]

#11 2010-06-16 09:26:50

Re: IP forwarding with iptables help [SOLVED]

#12 2010-06-16 14:39:31

Re: IP forwarding with iptables help [SOLVED]

Board footer