DNAT with iptables

[martin]

I'm trying to do some DNAT with iptables but that doesn't work for me, I Googled for some examples and according to them it should be working but it doesn't for me.

I can do something similar with socat like:

socat TCP4-LISTEN:8000,fork TCP4:192.168.11.3:8000

but I thought it'd be faster in the kernel than a userland program ;-)

My iptables setup is like that:

cat /proc/sys/net/ipv4/ip_forward
1

iptables -P FORWARD DROP
iptables -F
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -N int_fwd
iptables -A FORWARD -s 192.168.32.10 -d 192.168.0.0/255.255.0.0 -j int_fwd
iptables -A int_fwd -j ACCEPT

iptables -P PREROUTING ACCEPT
iptables -t nat -F

iptables -A PREROUTING -i eth0 -p tcp -m multiport --dports 8000 -j DNAT --to-destination 192.168.11.3

The firewall machine is on the 192.168.32.0 network and can reach 192.168.11.3, well it all works with socat but not with iptables.

Any clues? I use the same ports as I used with socat so the firewall is not blocking them out, I stop socat before testing with iptables of course ;-)

PS. Sorry if these rules are not enough, I didn't want to post the whole thing - only relevant parts.

PPS. Forgot to mention - I have an if before the -j ACCEPT in the stupid looking int_fwd chain, so if I set debug_log_nat=1 it logs it to syslog, same for PREROUTING. Both are logged.

[SeanW]

This is what I use to forward port 1234 to 192.168.1.10... Incoming int is eth1

iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 1234 -j DNAT --to-destination 192.168.1.10:1234

Not much difference except I'm using -m tcp and specifying the port in the destination... odd

Sean

[martin]

Weird, does it have to do anything with the fact that it should come and go on eth0? According to my understanding that shouldn't matter... but who knows.

[SeanW]

Take a look at this... It also an SNAT, too

[lists.netfilter.org...]

in this case both machines are on the same subnet, so the packet has to be source natted so that the translated packet gets back to the box with the nat translation.

Sean

[martin]

In my case the 2 boxes are on the same network and the 3rd to which I route is on a different network but accessible from the same router's card as is used to access the client.

It doesn't need SNAT to my knowledge, netfilter should figure out by itself that it's a DNAT'ed connection and forward it back to the client.

[martin]

Figured it out, yes you actually need both SNAT and DNAT to do that ;-)