Port forwarding for iptables (DMZ)
Posted by Steve on Fri 7 Jan 2005 at 10:52
If you have a network gateway which is running Linux you might sometimes want to allow access to machines behind it from the internet.
This is simple enough to do with iptables, which you will probably be using for the gateway's normal operation anyway.
Normally you'd deny all incoming connections to a gateway machine as opening up services and ports could be a security risk.
If you have a gateway machine and wish to forward connections on port 80 to an internal machine then you'd create the following rules:
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.50:80 iptables -A INPUT -p tcp -m state --state NEW --dport 80 -i eth1 -j ACCEPT
These two rules are fairly simple - the first says that all incoming tcp connections arriving destined for port 80 should be sent to the internal machine 192.168.1.50 (also on port 80).
This rule alone doesn't do the job though, we also have to accept the incoming connection. This is the job of the second rule which says that new connections on port 80 should be accepted on the external device eth1.
To increase security you could limit this forwarding to only work when connections are coming from a particular address with the use of the "--source" flag:
iptables -A PREROUTING -t nat -i eth1 -p tcp --source 11.22.33.44 \ --dport 80 -j DNAT --to 192.168.1.50:80
[ Send Message | View Steve's Scratchpad | View Weblogs ]
Steve
-- Steve.org.uk
[ Parent | Reply to this comment ]
If you try rc.firewall from http://iptables-tutorial.frozentux.net/iptables-tutorial.html#RCF IREWALLFILE,
you will see the difference, where the default policy for FORWARD is DROP instead of FORWARD.
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
Even in the case you mention it is not guaranteed, since Steve never DID specify (in his article) that any and all packets will have the IP address of the local machine. On the contrary: the whole point of his rule is to take anything directed to port 80 and point it to the IP address of the local machine. But what will it do, for example, to packets coming from another machine inside the firewall? Does such a machine always have to use only internal IP addresses? Again, it depends on the rest of the firewall configuration.
So unfortunately, this article is just not as helpful as it seems at first.
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
first post:/
this may sound stupid!, but would this work with the openSSH,
as in replacing the port 80 to port 22-?, just that id like to be safe than sorry
this is a really good site for new Debian users like my self !!
keep up the good work gents!!
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
Don't forget the ladies too!
Yes it should work for other ports too, so you have nothing to worry about.
Steve
--
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
It would make more sense to change the tor configuration to allow it to bind upon the external address - rather than using iptables for this.
Look at the configuration files under /etc/tor.
Steve
--
[ Parent | Reply to this comment ]
I have a server with debian that holds an entire network.
I have an internal ip like everyone else,and only 1 ip for the server,that everyone else uses.
I want to open a port on the server so I can become conectable on trackers for torrents,can any1 help me?
[ Parent | Reply to this comment ]
Unless you stop explaining things before you understand how they work and correct your article.
Forwarded packets DON'T enter -t filter INPUT chain.
Please don't confuse people.
[ Parent | Reply to this comment ]
Thanks Steve, you're a life saver!
Martha
[ Parent | Reply to this comment ]
how to config isa 2004 dmz
[ Parent | Reply to this comment ]
ie. - what should the rule set be if I want to route external traffic received on port 8090 to the internal IP 10.0.1.211:80 to allow the webserver traffic back to a browser on the internet?
TIA
[ Parent | Reply to this comment ]
iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0Otherwise, the response doesn't get back to the original machine and the connection appears to be filtered. At least this is what I found when trying to do forwarding. I appreciate that this is a few years too late to help but it might help someone else.
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
Hi Steve,
I know this is an old post but my experiments indicate you got something wrong that may frustrate people new to iptables firewalls.
is:
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.50:80 iptables -A INPUT -p tcp -m state --state NEW --dport 80 -i eth1 -j ACCEPT
should be:
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.50:80 iptables -A FORWARD -p tcp -i eth1 -o eth0 -d 192.168.1.50 --dport 80 -j ACCEPT
Your packet is going to enter the nat table's PREROUTING chain, then pass to the input table's FORWARD chain so that it can be sent from eth1 to eth0 and to it's destination.
[ Parent | Reply to this comment ]
BY HARISH
mailid harish.narang2000@gmail.com
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
The rest is ok.
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
Iam new to iptables. I would like to use it to forward the traffic on particular port to another port on the same host. what would be the rule to do so? Please let me know if this is possible at all.
Thanks in advance.
[ Parent | Reply to this comment ]
my email is ablozhou # gmail.com
my eth0 has been set a public IP,like 210.211.xx.x,and eth1 is a inner IP
:192.168.12.10. my web site has an inner IP 192.168.12.50.
the below sets on Centos 5.2 will be work.
On the gateway machine set ipv4 forward:
vi /etc/sysctl.conf
net.ipv4.ip_forward = 1
sysctl -p
you should see:
net.ipv4.ip_forward = 1
then you will set iptables to forward the ip packages
#nat表，PREROUTING链，设置&#x 5BF9;eth0的目标端口是80ݨ 4;tcp协议，放到DNAT，forward& #x5230;192.168.12.50:80
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j DNAT --to 192.168.12.50:80
#filter表，对接到的eth0ݨ 4;，从eth1转到192.168.12.50:80
iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 192.168.12.50 --dport 80 -j ACCEPT
#但是，也要做nat变c 62;，维护一份映射ࢆ 8;，从eth1送出时采用&#x 5185;网地址，回来时 3D8;为公网地址。否R 19;外网会收不到回 D;。
iptables -t nat -A POSTROUTING -j MASQUERADE -o eth1
run
service iptables save
this will work well.
thanks.
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
great article & comments!
Still valid after all these years.
I struggled yesterday with exactly this same situation:
my test environment: Debian Testing (Wheezy) with kernel 3.2.0, iptables 1.4.13-1.1 it seems to be working only with the two lines PREROUNTING & FORWARD.
On production environment, after going through the code for Xth time & mad,
I just realized that I need to explicitely MASQUERADE/SNAT inbound packets for port forwarding to work.
This is actually what Zhou says - it seems to be omitted in all documentation I have found. Usually only the two lines for PREROUTING&FORWARD are mentioned, but not this.
Here is my code running on Debian Squeeze (kernel 2.6.32, iptables 1.4.8-3):
/etc/sysctl.conf: net.ipv4.ip_forward = 1
iptables -t nat -A POSTROUTING -o $INT_IFACE -j SNAT --to-source=$THISMACHINE_INT_IP
iptables -t nat -I PREROUTING -i $EXT_IFACE -p tcp --dport 80 -j DNAT --to-destination $LANWEBSRV_IP:80
iptables -A FORWARD -i $EXT_IFACE -o $INT_IFACE -d $LANWEBSRV_IP -p tcp --dport 80 -j ACCEPT
Cheers,
Matej
[ Parent | Reply to this comment ]
/sbin/iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 3389 -j ACCEPT
/sbin/iptables -A PREROUTING -t nat -p tcp -d 123.123.123.123 --dport 39145 -j DNAT --to 192.168.60.3:3389
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Send Message ]
[ Parent | Reply to this comment ]