[ale] port forwarding for iptables.

[jim.kinney at gmail.com (Jim Kinney)]

all of the -j LOG calls will never trigger because the packet has
already left the chain due to the line before it with the -j ACCEPT or
-j DNAT. Put the log before the jump call.

-j REDIRECT is what you want to use. DNAT is for IP address. REDIRECT
is for port forwarding.

On Tue, Jun 9, 2009 at 1:16 PM, Atlanta Geek<atlantageek at gmail.com> wrote:
> OK. so I am trying to use portforwarding with iptables
>
> here is the output from ?'lsmod | grep iptable' , iptables-save and
> iptables --list
>
> any suggestions would be great
> The only thing that is a little weird with this is that I am
> forwarding ports within the same network. ?So maybe the -DNAT is
> screwing things up?
>
> *************OUTPUT of lsmod
> [root at krobinson sysconfig]# lsmod | grep iptable
> iptable_filter ? ? ? ? 36161 ?1
> iptable_nat ? ? ? ? ? ?40773 ?1
> ip_nat ? ? ? ? ? ? ? ? 53100 ?1 iptable_nat
> ip_conntrack ? ? ? ? ? 91236 ?5
> ip_conntrack_ftp,ip_conntrack_netbios_ns,xt_state,iptable_nat,ip_nat
> ip_tables ? ? ? ? ? ? ?55329 ?2 iptable_filter,iptable_nat
> x_tables ? ? ? ? ? ? ? 50377 ?8
> ipt_LOG,xt_state,iptable_nat,ip_tables,ip6_tables,ipt_REJECT,ip6t_REJECT,xt_tcpudp
>
> **********OUTPUT ?of 'iptables-save' START
> nat
> :PREROUTING ACCEPT [55:9852]
> :POSTROUTING ACCEPT [74:4440]
> :OUTPUT ACCEPT [74:4440]
> -A PREROUTING -d 10.0.0.39 -i eth0 -p tcp -m tcp --dport 5213 -j DNAT
> --to-destination 10.0.1.213:3001
> -A PREROUTING -d 10.0.0.39 -i eth0 -p tcp -m tcp --dport 5213 -j ?LOG
> --log-prefix "TCP PREROUTING:"
>
> COMMIT
> # Completed on Wed Jun 10 00:11:38 2009
> # Generated by iptables-save v1.3.5 on Wed Jun 10 00:11:38 2009
> *filter
> :INPUT ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [3459:642904]
> :RH-Firewall-1-INPUT - [0:0]
> -A INPUT -j RH-Firewall-1-INPUT
> -A FORWARD -j RH-Firewall-1-INPUT
> -A FORWARD -d 10.0.1.213 -i eth0 -p tcp -m tcp --dport 3001 -j ACCEPT
> -A FORWARD -d 10.0.1.213 -i eth0 -p tcp -m tcp --dport 3001 -j LOG
> --log-prefix "TCP FORWARD:"
> -A RH-Firewall-1-INPUT -i lo -j ACCEPT
> -A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
> -A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
> -A RH-Firewall-1-INPUT -p esp -j ACCEPT
> -A RH-Firewall-1-INPUT -p ah -j ACCEPT
> -A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
> -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
> -A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 3001 -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 5000 -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
> -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
> COMMIT
> # Completed on Wed Jun 10 00:11:38 2009
> ***************OUTPUT END
> But it does not seem to be working. ?The output from my iptables -l
> looks like the following
>
> *********OUTPUT 'iptables --list' ?START
> [root at krobinson sysconfig]# iptables --list
> Chain INPUT (policy ACCEPT)
> target ? ? prot opt source ? ? ? ? ? ? ? destination
> RH-Firewall-1-INPUT ?all ?-- ?anywhere ? ? ? ? ? ? anywhere
>
> Chain FORWARD (policy ACCEPT)
> target ? ? prot opt source ? ? ? ? ? ? ? destination
> RH-Firewall-1-INPUT ?all ?-- ?anywhere ? ? ? ? ? ? anywhere
> ACCEPT ? ? tcp ?-- ?anywhere ? ? ? ? ? ? lab-at2503 ? ? ? ? ?tcp
> dpt:redwood-broker
> LOG ? ? ? ?tcp ?-- ?anywhere ? ? ? ? ? ? lab-at2503 ? ? ? ? ?tcp
> dpt:redwood-broker LOG level warning prefix `TCP FORWARD:'
>
> Chain OUTPUT (policy ACCEPT)
> target ? ? prot opt source ? ? ? ? ? ? ? destination
>
> Chain RH-Firewall-1-INPUT (2 references)
> target ? ? prot opt source ? ? ? ? ? ? ? destination
> ACCEPT ? ? all ?-- ?anywhere ? ? ? ? ? ? anywhere
> ACCEPT ? ? all ?-- ?anywhere ? ? ? ? ? ? anywhere
> ACCEPT ? ? icmp -- ?anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ?icmp any
> ACCEPT ? ? esp ?-- ?anywhere ? ? ? ? ? ? anywhere
> ACCEPT ? ? ah ? -- ?anywhere ? ? ? ? ? ? anywhere
> ACCEPT ? ? udp ?-- ?anywhere ? ? ? ? ? ? 224.0.0.251 ? ? ? ? udp dpt:mdns
> ACCEPT ? ? udp ?-- ?anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ?udp dpt:ipp
> ACCEPT ? ? tcp ?-- ?anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ?tcp dpt:ipp
> ACCEPT ? ? all ?-- ?anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ?state
> RELATED,ESTABLISHED
> ACCEPT ? ? tcp ?-- ?anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ?state NEW
> tcp dpt:redwood-broker
> ACCEPT ? ? tcp ?-- ?anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ?state NEW
> tcp dpt:commplex-main
> ACCEPT ? ? tcp ?-- ?anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ?state NEW
> tcp dpt:http
> REJECT ? ? all ?-- ?anywhere ? ? ? ? ? ? anywhere
> reject-with icmp-host-prohibited
> **********OUTPUT END
> --
> http://www.atlantageek.com
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
>



-- 
-- 
James P. Kinney III
Actively in pursuit of Life, Liberty and Happiness