IPtables: DNAT not working
Posted
by
GetFree
on Server Fault
See other posts from Server Fault
or by GetFree
Published on 2011-02-26T06:16:51Z
Indexed on
2011/02/26
7:26 UTC
Read the original article
Hit count: 305
In a CentOS server I have, I want to forward port 8080 to a third-party webserver.
So I added this rule:
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination thirdparty_server_ip:80
But it doesn't seem to work.
In an effort to debug the process, I added these two LOG rules:
iptables -t mangle -A PREROUTING -p tcp --src my_laptop_ip --dport ! 22 -j LOG --log-level warning --log-prefix "[_REQUEST_COMING_FROM_CLIENT_] "
iptables -t nat -A POSTROUTING -p tcp --dst thirdparty_server_ip -j LOG --log-level warning --log-prefix "[_REQUEST_BEING_FORWARDED_] "
(the --dport ! 22
part is there just to filter out the SSH traffic so that my log file doesn't get flooded)
According to this page the mangle/PREROUTING
chain is the first one to process incomming packets and the nat/POSTROUTING
chain is the last one to process outgoing packets.
And since the nat/PREROUTING
chain comes in the middle of the other two, the three rules should do this:
- the rule in
mangle/PREROUTING
logs the incomming packets - the rule in
nat/PREROUTING
modifies the packets (it changes the dest IP and port) - the rule in
nat/POSTROUTING
logs the modified packets about to be forwarded
Although the first rule does log incomming packets comming from my laptop, the third rule doesn't log the packets which are supposed to be modified by the second rule. It does log, however, packets that are produced in the server, hence I know the two LOG rules are working properly.
Why are the packets not being forwarded, or at least why are they not being logged by the third rule?
PS: there are no more rules than those three. All other chains in all tables are empty and with policy ACCEPT.
© Server Fault or respective owner