Iptables and Port Forwarding Issues.

I am trying to forward a single port from the outside box (linux) to
the inside box (win2k3 server). The service on the inside machine is a
webserver on a nonstandard port.

I have tried these iptables lines and they have failed me.

iptables -t nat -A PREROUTING -p tcp -i eth0 -d 65.xx.xx.xx --dport 188
-j DNAT --to 192.168.1.xxx:188
iptables -A FORWARD -p tcp -i eth0 -d 192.168.1.xxx --dport 188 -j
ACCEPT

My setup.

internt <---> 65.*.*.* eth0 <linux box> 192.168.1.1 eth0:0 <--->
192.168.1.* <win2k3 server>

>From the linux machine I can request pages from the 192.168.1.* address
just fine http://192.168.1.*:188 I want to be able to access the pages
via 65.*.*.*:188

the only other rules I use are:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Hi Chris -

On 28 Sep 2005 11:34:47 -0700, (E-Mail Removed) wrote:

>iptables -t nat -A PREROUTING -p tcp -i eth0 -d 65.xx.xx.xx --dport 188
>-j DNAT --to 192.168.1.xxx:188

This should work when the request is actually coming from the
internet.

If the request is coming the 192.168.1.x network, I think it won't
work because of
-i eth0

Try it without
-i eth0

--
Ken
http://www.ke9nr.net/

> >iptables -t nat -A PREROUTING -p tcp -i eth0 -d 65.xx.xx.xx --dport 188
> >-j DNAT --to 192.168.1.xxx:188
>
> This should work when the request is actually coming from the
> internet.
>
> If the request is coming the 192.168.1.x network, I think it won't
> work because of
> -i eth0
>
> Try it without
> -i eth0
>


Ken,

Not really sure why removing the -i eth0 worked but it did. I was
testing exclusively from outside the network all packets were comming
in over the external interface. Once I removed the -i eth0 it started
working.

Thanks,
Chris

Hi Chris -

On 28 Sep 2005 14:49:19 -0700, (E-Mail Removed) wrote:

>Not really sure why removing the -i eth0 worked but it did. I was
>testing exclusively from outside the network all packets were comming
>in over the external interface. Once I removed the -i eth0 it started
>working.

I suggest using a LOG rule temporarily so that you can see what is
going on.

--
Ken
http://www.ke9nr.net/