Home / server / Questions / 240532
Accepted
GetFree
Asked: 2011-02-26 22:16:51 +0800 CST

IPtables: DNAT not working

  • 772

In a CentOS server I have, I want to forward port 8080 to a third-party webserver.
So I added this rule:

iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination thirdparty_server_ip:80

But it doesn't seem to work.
In an effort to debug the process, I added these two LOG rules:

iptables -t mangle -A PREROUTING -p tcp --src my_laptop_ip --dport ! 22 -j LOG --log-level warning --log-prefix "[_REQUEST_COMING_FROM_CLIENT_] "
iptables -t nat -A POSTROUTING -p tcp --dst thirdparty_server_ip  -j LOG --log-level warning --log-prefix "[_REQUEST_BEING_FORWARDED_] "

(the --dport ! 22 part is there just to filter out the SSH traffic so that my log file doesn't get flooded)

According to this page the mangle/PREROUTING chain is the first one to process incomming packets and the nat/POSTROUTING chain is the last one to process outgoing packets.

And since the nat/PREROUTING chain comes in the middle of the other two, the three rules should do this:

  1. the rule in mangle/PREROUTING logs the incomming packets
  2. the rule in nat/PREROUTING modifies the packets (it changes the dest IP and port)
  3. the rule in nat/POSTROUTING logs the modified packets about to be forwarded

Although the first rule does log incomming packets comming from my laptop, the third rule doesn't log the packets which are supposed to be modified by the second rule. It does log, however, packets that are produced in the server, hence I know the two LOG rules are working properly.

Why are the packets not being forwarded, or at least why are they not being logged by the third rule?

PS: there are no more rules than those three. All other chains in all tables are empty and with policy ACCEPT.

firewall linux port-forwarding iptables

2 Answers

  1. Best Answer

    You may need to turn on ip forwarding on the server. Try

    echo 1 > /proc/sys/net/ipv4/ip_forward

    • 6

  2. It's all highly dependent on whether the clients, you're doing DNAT for, use your NAT-box as a gateway (+ actually replies back would use your NAT-box as well) OR NOT.

    I guess they don't so then the following describes fault: {

    When doing DNAT you're masking the Effective-IP with a Relay-IP belonging to NAT-box (from clients' PoV). So, a client expects to communicate with Relay-IP, not Effective-IP. Instead, client all of the sudden receives replies from Effective-IP he hasn't ever heard of.

    So, when doing such a masking w/o being an intermediate gateway between client and Effective-service you need as well use SNAT (hiding clients with NAT-box-external-IP), so all replies from the Effective-IP service box go back to your NAT-gateway and then only would be de-NATed and sent back to client who initiated this.

    }

    • 2