Forgot your password?
typodupeerror
Mandriva Businesses

IPTables and Port Forwarding? 41

Posted by Cliff
from the finding-the-right-reference dept.
$hy_guy asks: "I have been totally striking out finding some info on how to do port forwarding in Linux. I am currently running Mandrake 8.1 as my router and i would like to forward a particular port to another machine on my LAN. I'm pretty sure I have to use iptables but I have been very unsuccesful at the proper syntax. I have scoured through Google and I have not really found any useful info. I would appreciate just a link or something to point me the correct direction. Thanks for the help" I know many of you may think this is an FAQ, but it seems that IPTables confuses many people as this is not the first time this question has hit the bin. If someone has a good general reference on the use of IPTables, please share.
This discussion has been archived. No new comments can be posted.

IPTables and Port Forwarding?

Comments Filter:
  • I use MonMotha's IPTables script [mplug.org] to build my firewall. You tell it which ports to leave open and it closes the rest. It also has stuff in there for rate limiting and stuff, I think. According to that page, the beta does port forwarding.
  • Docs abound (Score:4, Informative)

    by jmd! (111669) <jmd@@@pobox...com> on Wednesday January 23, 2002 @05:36PM (#2890798) Homepage
    Netfilter is extremely well documented... this poster must not have tried very hard.

    Home page: http://www.netfilter.org/ [netfilter.org]

    FAQs: http://www.netfilter.org/documentation/FAQ/netfilt er-faq.html [netfilter.org]

    Excellent HOWTOs: http://www.netfilter.org/documentation/index.html# HOWTO [netfilter.org]
  • google and howto (Score:2, Redundant)

    by gus goose (306978)
    So, I Googled [google.com], then chose the 2.4 NAT Howto, Section 6.2 [samba.org]

    Why is that so hard?

    gus

    • Re:google and howto (Score:4, Informative)

      by Raptor CK (10482) on Wednesday January 23, 2002 @05:47PM (#2890865) Journal
      It seems simple, but I'll bet that today's kids forget to use "howto" as a search parameter.

      Go ahead, Google "iptables port forwarding" and see how much worse those results are.

      This just goes to show that we need more basic user education. RTFM should be preceded by RTFH (Read The Fucking HOWTO!) so that people at least know what to look for when they're stumped.

      Kids these days...
  • pffff (Score:3, Informative)

    by Smoking (24594) on Wednesday January 23, 2002 @05:47PM (#2890864) Homepage
    This one's a bit easy:

    Step one: go to http://www.netfilter.org [netfilter.org]

    step two: find the HOWTO section

    step three: fifth line of the HTML version of the NAT-HOWTO reads like this: This document describes how to do masquerading, transparent proxying, port forwarding, and other forms of Network Address Translations with the 2.4 Linux Kernels.

    step four:Wait, there's no step four... there's no step four!

    Quentin
  • 'tis Quite Easy (Score:5, Informative)

    by Jester998 (156179) on Wednesday January 23, 2002 @05:48PM (#2890876) Homepage
    Heh... by coincidence, I just finished a project for the local hospital... I was coding a full-featured firewall based on Linux, and it had to integrate seamlessly with a WinNT network, including limiting 'net access by user name, and it had to work totally transparently for the users. Since a number of people in the hospital use Remotely Anywhere to connect from home, port forwarding became an issue for us.

    The syntax for port forwarding is:

    iptables -t nat -I PREROUTING -p <protocol> --dport <destination port> -j DNAT --to-destination <destination IP>:<destination port>

    Note that you can remap port numbers, too, if need be (ie. traffic coming in on port 80 is redirected internally to port 5000).

    Make sure you have the destination NAT target compiled in (I think it might be, by default), and make sure you enable all the NAT stuff you need.
    • I would be quite interested in how you limited net access by user name if it was the user name of the logged in user that was being used. I am currently trying to do this, restrict net access based on user instead of physical hardware, on my home network (Win98 and Win2000 clients, Linux firewall) but have not been successful.
      • Well, there's two ways, each with their disadvantages: You can either use a modified 'nbtstat' (from Samba), or you can have a 'finger'-style daemon running on all the machines.

        The 'nbtstat' method has a few disadvantages, including the fact that if a user logs onto two stations at once, only the most recently logged-on station will return a user name, and also that the returned ID codes (0x03) are the same for machine name and username... ;(

        The daemon method is more-or-less foolproof, but you need to deploy all the daemons... easy if you have login scripts set up from a centralized server, but a pain in the ass if you don't. Plus, you'd need to write the daemon software. Shouldn't be more than 100 lines or so (at most).

        In either case, you have to queue packets to userspace by using the appropriate kernel module (ip_queue, IIRC), and a QUEUE target in your iptables rules.

        Took me a while to figure out, too, and you have to decide which model is best for your network.
        Either way, you basically need to write at least SOME code, so this is not for the faint of heart!

        Good luck!
  • iptables -t nat -A PREROUTING -i eth0 -p TCP --dport 80 -j DNAT --to 192.168.1.2

    (To forward port 80 to 192.168.1.2 on LAN. eth0 is your external interface)
  • if you want to get into the kernel's routing abilities, check http://ds9a.nl/lartc/HOWTO//cvs/2.4routing/output/ 2.4routing.html [ds9a.nl]. this site is _the_ place to go for info on the subject. But if you want to keep it simple, stay with the suggested netfilter sites.
  • Here's how (Score:4, Informative)

    by jquirke (473496) on Wednesday January 23, 2002 @05:57PM (#2890923)
    Yeah it's not as obvious as first, but it's actually pretty simple.

    OK here's an example: our gateway is 192.168.0.1 with lan interface eth0 and internet interface eth1. We want to redirect port 21 (FTP) to the machine 192.168.0.10

    First of all, we need to add a rule matching incoming data to port 21. We use the PREROUTING chain in the NAT table:

    iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 21 -j DNAT --to-destination 192.168.0.10

    This says: in the network address translation table and the chain that deals with incoming data prior to routing, and if the data is coming in from the internet and wants to go to TCP port 21 (ftp), DNAT (destination network address translate) it to transparently make it go to 192.168.0.10

    Here's a generic template:

    iptables -t nat -A PREROUTING -i [net interface] [selection rules - proto, port] -j DNAT --to-destination [ip on lan]

    You can also redirect to a different port number, in the above example to redirect to 192.168.0.10 port 321 it would be:

    --to-destination 192.168.0.10:321

    As for this being an FAQ, I am aware of no such references on IPTables, and it doesn't matter. I think the manual page provides more than sufficient information to get you started. If you don't understand it, then you should not be administering a gateway of any kind!
    • Of course, most of the time you'll have the default policy for FORWARD on DROP, or something. And you'll have SNAT from the inside ACCEPT(ed).

      Now, you have to add a FORWARD ACCEPT statement (in the default table) like this:
      iptables -A FORWARD -i eth1 -p tcp -d 192.168.1.2 --dport 21 -j ACCEPT

      Another thing, is that for ftp traffic to work, you'll need an state of RELATED to be entered somewhere.
    • Well written. I saved this comment as a text file in case I'll ever need to use it.
  • I spent a while fooling with various IPTables scripts, but finnally settled on the gpl'd shorewall [shorewall.net] package.

    It handles all my iptables configuration, including NAT with port forwarding.
  • There was a good article in September 2001 issue of Linux Journal. Scripts are available at ftp.ssc.com/pub/lj/listings/issue89/
    • See http://www.linuxjournal.com/article.php?sid=3575 [linuxjournal.com] for another Linux Journal article on setting up a firewall with various features including port forwarding. This article predates the 2.4 kernel, so it's not relevant to iptables, but if you're running a 2.0 or 2.2 kernel, you should find an example there.

      I just ran across it today when setting up a network. (You would think I would have remembered, considering that I wrote the article.)
  • FwBuilder ROCKS ! (Score:2, Interesting)

    by Bitsy Boffin (110334)
    If you have X running, not necessarily on your firewall (you just use fwbuilder to "compile" a script and run the script on the firewall box) then I can heartily recommend fwbuilder [fwbuilder.org].

    It's a totally object based graphical tool for building a firewall. You can just drag and drop "services" (ports) to create port mappings, drap and drop machines, other firewalls, networks, etc to determin who gets to do what.

    Has a nice little druid in it to get you a working setup that you can modify to better suit your needs.

    Really. Check it out.

    • I agree - fwbuilder is really good. If iptables confuses you have a play with this little beauty and then of course read over the generated rules. It will all make a lot more sense ;).
  • Besides standard iptables functions, you can easily patch your kernel and add extra features.
    Just download iptables [samba.org], uncompress it, and run 'make patch-o-matic', provided you have a source tree in /usr/src/linux. Then you can choose wich patches to apply. The ones I'm using are:

    The NETMAP patch:
    Author: Svenning Soerensen
    Status: Experimental

    This adds CONFIG_IP_NF_TARGET_NETMAP option, which provides a target for the nat table. It creates a static 1:1 mapping of the network address, while keeping host addresses intact. It can be applied to the PREROUTING chain to alter the destination of incoming connections, to the POSTROUTING chain to alter the source of outgoing connections, or both (with separate rules).


    Examples:

    iptables -t nat -A PREROUTING -d 1.2.3.0/24 -j NETMAP --to 5.6.7.0/24
    iptables -t nat -A POSTROUTING -s 5.6.7.0/24 -j NETMAP --to 1.2.3.0/24

    ---

    The TTL patch:
    Author: Harald Welte
    Status: Stable, needs new checksum handling
    This adds CONFIG_IP_NF_TARGET_TTL option, which enables the user to set the TTL value of an IP packet or to increment / decrement it by a given value.

    ---

    The iplimit patch:
    Author: Gerd Knorr
    Status: ItWorksForMe[tm]

    This adds CONFIG_IP_NF_MATCH_IPLIMIT match allows you to restrict the number of parallel TCP connections to a server per client IP address (or address block).

    Examples:

    # allow 2 telnet connections per client host iptables -p tcp --syn --dport 23 -m iplimit --iplimit-above 2 -j REJECT

    # you can also match the other way around: iptables -p tcp --syn --dport 23 -m iplimit ! --iplimit-above 2 -j ACCEPT

    # limit the nr of parallel http requests to 16 per class C sized # network (24 bit netmask) iptables -p tcp --syn --dport 80 -m iplimit --iplimit-above 16 --iplimit-mask 24 -j REJECT

    ---

    The random patch:
    Author: Fabrice MARIE
    Status: Works For Me.

    This option adds CONFIG_IP_NF_MATCH_RANDOM, which allow you to match packets randomly following a given probability.

    Suppported options are:

    [--average] percent will match randomly packets with a probability of 'percent' default is 50%

    ---

    The string patch:
    Author: Emmanuel Roger
    Status: Working, not with kernel 2.4.9
    This patch adds CONFIG_IP_NF_MATCH_STRING which allows you to match a string in a whole packet.

    ---
    and iptables 1.2.5 , wich I haven't compiled yet, so cannot tell for sure, has something that seems to be awesome... New quota match to have fixed IP quotas
  • by hack0rama (253610) on Wednesday January 23, 2002 @07:29PM (#2891412) Homepage Journal

    Pleasee see my page [hackorama.com] with detailed instructions on how I did port forwarding on my Mandrake 8.1 box, which uses Bastille scripts to generate the Iptable rules.
  • Anyone tried using a transparent SOCKS proxy for this task? I know there is one in Debian, but does anyone know how well it works? I'd basically like to be able to get Netmeeting and P2P to work from behind my firewall when I'm trying to connect to someone else who's behind a firewall. Thanks,

    David
  • What there aren't enough of is plan old examples. Here is my configuration. xxx's replace personal info. :)

    iface eth1 inet static
    address 209.195.xxx.xxx
    netmask 255.255.255.224
    gateway 209.195.xxx.xxx

    iface eth0 inet static
    address 10.10.10.1
    netmask 255.255.255.0
    network 10.10.10.0
    broadcast 10.10.10.255
    up /sbin/iptables -t nat -F
    up /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
    up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 2021 -j DNAT --to 10.10.10.2:21
    up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 2022 -j DNAT --to 10.10.10.2:22
    up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 2080 -j DNAT --to 10.10.10.2:80
    up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 33022 -j DNAT --to 10.10.10.33:22
    up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 33021 -j DNAT --to 10.10.10.33:21
    up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 25022 -j DNAT --to 10.10.10.25:22
    up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 5800 -j DNAT --to 10.10.10.3:5800
    up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 5900 -j DNAT --to 10.10.10.3:5900
    up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 5801 -j DNAT --to 10.10.10.2:5801
    up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 5901 -j DNAT --to 10.10.10.2:5901
  • gShield [linuxmafia.org] is a nice package that uses well-commented config files and scripts to setup an iptables firewall. Quote from page:

    support for multiple NATs, configurable public service access, access control lists, routable protection, DMZ support, port-forwarding, MAC-specific filtering, configurable outgoing filtering, blacklists, support for transparent proxy, QoS marking of common transports and more.

    I use it at work and at home. One caveat since you are using Mandrake: gShield.rc is not a SysVinit script, so /sbin/ntsysv (or whatever SysVinit config tool you are using)will not be able to configure it into runlevels without modification. Personally, I am running it out of rc.local.

The rich get rich, and the poor get poorer. The haves get more, the have-nots die.

Working...