iptables: rerouting calls to external IP directly to local IP address

Revelation60 · 2010-06-26 09:40:05

I am writing a multiplayer game, and for testing I am running the server and client on the same computer. The server connects to a master server, so the client receives the WAN IP of the local server. My router however, does not allow communication from the inside to the inside using the external IP. This has nothing to do with port forwarding (I should note that only the ISP has admin rights of the router). When my partner tries to login from an external pc, everything is fine.

Then the idea came to mind to reroute traffic to my external IP directly to my local IP. This is my iptables config file:

*nat
PREROUTING ACCEPT [0:0]
OUTPUT ACCEPT [528:31680]
POSTROUTING ACCEPT [528:31680] PREROUTING -d 87.209.57.151 -j DNAT --to-destination 192.168.1.3
COMMIT

87.209.57.151 is my WAN IP and 192.168.1.3 is my local address. This is not working however. What am I doing wrong?

Sin.citadel · 2010-06-26 14:35:16

so, your local server first connects to a master server and transfer info/etc. your client connects to the local server only for communication, or that the local server tells the client after connection to use a specific WAN server for communication?

Revelation60 · 2010-06-26 14:44:33

The local servers registers itself with a master server. The client connects to the master server to get a list of servers. Then if you select a server, you connect to it. If you happen to connect to a server that is on your LAN, you are connecting to a local server through the external IP, because that one gets registered on the master server.

Sin.citadel · 2010-06-26 20:38:08

if your local server has an interface with a WAN IP assigned to it, and the clients inside the NAT ask for services for your WAN IP, your local server (at least linux) doesnt try to NAT the connection and then forward it to internet, it directly connects you with your local server.

if you have access to directly attach a WAN IP, you should try using that, otherwise you can configure your router to forward all inbound traffic to your machine (DMZ)

fukawi2 · 2010-06-27 09:57:09

That should work, but don't forget you'll need a rule in the FILTER table to allow the traffic back (bounce routing)

Assuming your LAN is eth1:

-i eth1 -o eth1 -j ACCEPT

Of course, if this is on your local machine (not a separate firewall/gateway) then it would actually need to be loopback interface:

-i lo -o lo -j ACCEPT

Revelation60 · 2010-06-27 10:04:07

I am really a beginner with iptables. Could you please give the whole command? The server is running on my local machine, btw. Thanks!

edit:

is this what you mean?

 *filter
 :INPUT ACCEPT [1579:938624]
 :FORWARD ACCEPT [0:0]
 :OUTPUT ACCEPT [1681:275967]
 -A FORWARD -i lo -o lo -j ACCEPT 
 COMMIT

If so, it isn' t working yet

Last edited by Revelation60 (2010-06-27 11:30:25)

fukawi2 · 2010-06-27 23:12:03

What is the output of:

iptables -nvL
iptables -t nat -nvL

Revelation60 · 2010-07-02 12:48:11

Sorry for the late reaction. I only have this computer available in the weekends.

Output of iptables -nvL:

Chain INPUT (policy ACCEPT 29385 packets, 39M bytes)
 pkts bytes target     prot opt in     out     source               destination         
 837K   86M ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 19236 packets, 1985K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 837K   86M ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0

And of iptables -t nat -nvL:

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            87.209.57.151       udp dpt:1234 to:192.168.1.3 

Chain OUTPUT (policy ACCEPT 81192 packets, 4874K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 81192 packets, 4874K bytes)
 pkts bytes target     prot opt in     out     source               destination

I tried 192.168.1.3 instead of 127.0.0.1.

hunterthomson · 2010-07-03 02:52:53

Okay I'm going to repeat what I think your trying to do....

So in that picture describes how the physical and network is setup.
You have Port forwarding set- up to

Client + Server
192.168.1.3
|
|
|
Router-NAT -------- The Game Ports are forwarded to IP 192.168.1.3
87.209.57.151
|
|
|
Master Server
123.45.67.89

- You want to do is run a Game Server on your computer.
- You want your friends to be able to connect to it and play.
- You also want to connect to it and play.

- WORKING -
- Your Friends are able to connect to your Game Server and play. SO. . .
= Server IS working
= Ports are Forwarded

- NOT WORKING -
- You can not connect to your Game Server from the client running on the same box by using the Public IP address.

########################################

What Game is it ?
Dose the Game Client have a Network option to "Connect to local Server" or LAN Server ?

If your friends CAN connect and play then you should NOT bother with the Master Game Server. Just chose to connect to a Local Server and then type in the loop back address 127.0.0.1 or 192.168.1.3

You should not need to setup any routing rules on your Client/Server computer. Just port forwarding on the router.

..Edited out gibberish.

Last edited by hunterthomson (2010-07-03 04:08:51)

fukawi2 · 2010-07-03 03:20:58

hunterthomson wrote:

Owe,... Also do you have the loop back module in your rc.conf file....
MODULES=(loop .........)

No no no no!! The kernel 'loop' module has nothing to do with networking!

Move your DNAT rule from PREROUTING to OUTPUT in the nat table... Because all the traffic is local (ie, not a firewall separate to your computer) the traffic doesn't get passed through PREROUTING, only OUTPUT.

hunterthomson · 2010-07-03 04:07:02

Owe okay, that make sens now that I think about it.

Revelation60 · 2010-07-03 08:41:39

It is working now! The OUTPUT line did the trick

What Game is it ?
Dose the Game Client have a Network option to "Connect to local Server" or LAN Server ?

It is an open-source game called WalledIn I am writing with a friend. It does not have a LAN feature yet.

Arch Linux

#1 2010-06-26 09:40:05

iptables: rerouting calls to external IP directly to local IP address

#2 2010-06-26 14:35:16

Re: iptables: rerouting calls to external IP directly to local IP address

#3 2010-06-26 14:44:33

Re: iptables: rerouting calls to external IP directly to local IP address

#4 2010-06-26 20:38:08

Re: iptables: rerouting calls to external IP directly to local IP address

#5 2010-06-27 09:57:09

Re: iptables: rerouting calls to external IP directly to local IP address

#6 2010-06-27 10:04:07

Re: iptables: rerouting calls to external IP directly to local IP address

#7 2010-06-27 23:12:03

Re: iptables: rerouting calls to external IP directly to local IP address

#8 2010-07-02 12:48:11

Re: iptables: rerouting calls to external IP directly to local IP address

#9 2010-07-03 02:52:53

Re: iptables: rerouting calls to external IP directly to local IP address

#10 2010-07-03 03:20:58

Re: iptables: rerouting calls to external IP directly to local IP address

#11 2010-07-03 04:07:02

Re: iptables: rerouting calls to external IP directly to local IP address

#12 2010-07-03 08:41:39

Re: iptables: rerouting calls to external IP directly to local IP address

Board footer