IPTables and Port Forwarding?

$hy_guy asks: "I have been totally striking out finding some info on how to do port forwarding in Linux. I am currently running Mandrake 8.1 as my router and i would like to forward a particular port to another machine on my LAN. I'm pretty sure I have to use iptables but I have been very unsuccesful at the proper syntax. I have scoured through Google and I have not really found any useful info. I would appreciate just a link or something to point me the correct direction. Thanks for the help" I know many of you may think this is an FAQ, but it seems that IPTables confuses many people as this is not the first time this question has hit the bin. If someone has a good general reference on the use of IPTables, please share.

Check MonMotha's IPTables scripts...

[Evro]

I use MonMotha's IPTables script [mplug.org] to build my firewall. You tell it which ports to leave open and it closes the rest. It also has stuff in there for rate limiting and stuff, I think. According to that page, the beta does port forwarding.

Docs abound

[jmd!]

Netfilter is extremely well documented... this poster must not have tried very hard.

Home page: http://www.netfilter.org/ [netfilter.org]

FAQs: http://www.netfilter.org/documentation/FAQ/netfilt er-faq.html [netfilter.org]

Excellent HOWTOs: http://www.netfilter.org/documentation/index.html# HOWTO [netfilter.org]

google and howto

[gus goose]

So, I Googled [google.com], then chose the 2.4 NAT Howto, Section 6.2 [samba.org]

Why is that so hard?

gus

Re:google and howto

[Raptor CK]

It seems simple, but I'll bet that today's kids forget to use "howto" as a search parameter.

Go ahead, Google "iptables port forwarding" and see how much worse those results are.

This just goes to show that we need more basic user education. RTFM should be preceded by RTFH (Read The Fucking HOWTO!) so that people at least know what to look for when they're stumped.

Kids these days...

pffff

[Smoking]

This one's a bit easy:

Step one: go to http://www.netfilter.org [netfilter.org]

step two: find the HOWTO section

step three: fifth line of the HTML version of the NAT-HOWTO reads like this: This document describes how to do masquerading, transparent proxying, port forwarding, and other forms of Network Address Translations with the 2.4 Linux Kernels.

step four:Wait, there's no step four... there's no step four!

Quentin

'tis Quite Easy

[Jester998]

Heh... by coincidence, I just finished a project for the local hospital... I was coding a full-featured firewall based on Linux, and it had to integrate seamlessly with a WinNT network, including limiting 'net access by user name, and it had to work totally transparently for the users. Since a number of people in the hospital use Remotely Anywhere to connect from home, port forwarding became an issue for us.

The syntax for port forwarding is:

iptables -t nat -I PREROUTING -p <protocol> --dport <destination port> -j DNAT --to-destination <destination IP>:<destination port>

Note that you can remap port numbers, too, if need be (ie. traffic coming in on port 80 is redirected internally to port 5000).

Make sure you have the destination NAT target compiled in (I think it might be, by default), and make sure you enable all the NAT stuff you need.

Re:Limiting access by username

[Lord Sauron]

He apparently did it by IP address.
But there's another way:

owner
This module attempts to match various characteristics of the packet creator, for locally-generated packets. It is only valid in the OUTPUT chain, and even this some packets (such as ICMP ping responses) may have no owner, and hence never match.

--uid-owner userid
Matches if the packet was created by a process with the given effective user id.

--gid-owner groupid
Matches if the packet was created by a process with the given effective group id.

--pid-owner processid
Matches if the packet was created by a process with the given process id.

--sid-owner sessionid
Matches if the packet was created by a process in the given session group.
And with Iptables 1.2.5 [samba.org] you can even establish quotas per user.

Re:Limiting access by username

[murreyaw]

Thanks for the info. Very Helpful. I just finished a similar project.

Re:Limiting access by username

[Jester998]

Yes, that method works, too, but the *ID matches only processes/users/groups on the local machine, IIRC.

Yes, I did actually do the port forwarding by IP, since anyone who has Remotely Anywhere access has a static IP on their station.

But the outgoing connections are limited by NT username.

Re:'tis Quite Easy

[jmorey]

I would be quite interested in how you limited net access by user name if it was the user name of the logged in user that was being used. I am currently trying to do this, restrict net access based on user instead of physical hardware, on my home network (Win98 and Win2000 clients, Linux firewall) but have not been successful.

Re:'tis Quite Easy

[Jester998]

Well, there's two ways, each with their disadvantages: You can either use a modified 'nbtstat' (from Samba), or you can have a 'finger'-style daemon running on all the machines.

The 'nbtstat' method has a few disadvantages, including the fact that if a user logs onto two stations at once, only the most recently logged-on station will return a user name, and also that the returned ID codes (0x03) are the same for machine name and username... ;(

The daemon method is more-or-less foolproof, but you need to deploy all the daemons... easy if you have login scripts set up from a centralized server, but a pain in the ass if you don't. Plus, you'd need to write the daemon software. Shouldn't be more than 100 lines or so (at most).

In either case, you have to queue packets to userspace by using the appropriate kernel module (ip_queue, IIRC), and a QUEUE target in your iptables rules.

Took me a while to figure out, too, and you have to decide which model is best for your network.
Either way, you basically need to write at least SOME code, so this is not for the faint of heart!

Good luck!

Here's how to forward a port.

[chakradeo]

iptables -t nat -A PREROUTING -i eth0 -p TCP --dport 80 -j DNAT --to 192.168.1.2

(To forward port 80 to 192.168.1.2 on LAN. eth0 is your external interface)

Linux advanced routing how-to

[eufaula]

if you want to get into the kernel's routing abilities, check http://ds9a.nl/lartc/HOWTO//cvs/2.4routing/output/ 2.4routing.html [ds9a.nl]. this site is _the_ place to go for info on the subject. But if you want to keep it simple, stay with the suggested netfilter sites.

Here's how

[jquirke]

Yeah it's not as obvious as first, but it's actually pretty simple.

OK here's an example: our gateway is 192.168.0.1 with lan interface eth0 and internet interface eth1. We want to redirect port 21 (FTP) to the machine 192.168.0.10

First of all, we need to add a rule matching incoming data to port 21. We use the PREROUTING chain in the NAT table:

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 21 -j DNAT --to-destination 192.168.0.10

This says: in the network address translation table and the chain that deals with incoming data prior to routing, and if the data is coming in from the internet and wants to go to TCP port 21 (ftp), DNAT (destination network address translate) it to transparently make it go to 192.168.0.10

Here's a generic template:

iptables -t nat -A PREROUTING -i [net interface] [selection rules - proto, port] -j DNAT --to-destination [ip on lan]

You can also redirect to a different port number, in the above example to redirect to 192.168.0.10 port 321 it would be:

--to-destination 192.168.0.10:321

As for this being an FAQ, I am aware of no such references on IPTables, and it doesn't matter. I think the manual page provides more than sufficient information to get you started. If you don't understand it, then you should not be administering a gateway of any kind!

Re:Here's how

[Sendy]

Of course, most of the time you'll have the default policy for FORWARD on DROP, or something. And you'll have SNAT from the inside ACCEPT(ed).

Now, you have to add a FORWARD ACCEPT statement (in the default table) like this:
iptables -A FORWARD -i eth1 -p tcp -d 192.168.1.2 --dport 21 -j ACCEPT

Another thing, is that for ftp traffic to work, you'll need an state of RELATED to be entered somewhere.

Re:Here's how

[man_ls]

Well written. I saved this comment as a text file in case I'll ever need to use it.

My setup...

[kilgore_47]

I spent a while fooling with various IPTables scripts, but finnally settled on the gpl'd shorewall [shorewall.net] package.

It handles all my iptables configuration, including NAT with port forwarding.

Linux Journal

[fuzzbrain]

There was a good article in September 2001 issue of Linux Journal. Scripts are available at ftp.ssc.com/pub/lj/listings/issue89/

Re:Linux Journal

[crow]

See http://www.linuxjournal.com/article.php?sid=3575 [linuxjournal.com] for another Linux Journal article on setting up a firewall with various features including port forwarding. This article predates the 2.4 kernel, so it's not relevant to iptables, but if you're running a 2.0 or 2.2 kernel, you should find an example there.

I just ran across it today when setting up a network. (You would think I would have remembered, considering that I wrote the article.)

FwBuilder ROCKS !

[Bitsy Boffin]

If you have X running, not necessarily on your firewall (you just use fwbuilder to "compile" a script and run the script on the firewall box) then I can heartily recommend fwbuilder [fwbuilder.org].

It's a totally object based graphical tool for building a firewall. You can just drag and drop "services" (ports) to create port mappings, drap and drop machines, other firewalls, networks, etc to determin who gets to do what.

Has a nice little druid in it to get you a working setup that you can modify to better suit your needs.

Really. Check it out.

Re:FwBuilder ROCKS !

[The Whinger]

I agree - fwbuilder is really good. If iptables confuses you have a play with this little beauty and then of course read over the generated rules. It will all make a lot more sense ;).

make patch-o-matic

[Lord Sauron]

Besides standard iptables functions, you can easily patch your kernel and add extra features.
Just download iptables [samba.org], uncompress it, and run 'make patch-o-matic', provided you have a source tree in /usr/src/linux. Then you can choose wich patches to apply. The ones I'm using are:

The NETMAP patch:
Author: Svenning Soerensen
Status: Experimental

This adds CONFIG_IP_NF_TARGET_NETMAP option, which provides a target for the nat table. It creates a static 1:1 mapping of the network address, while keeping host addresses intact. It can be applied to the PREROUTING chain to alter the destination of incoming connections, to the POSTROUTING chain to alter the source of outgoing connections, or both (with separate rules).


Examples:

iptables -t nat -A PREROUTING -d 1.2.3.0/24 -j NETMAP --to 5.6.7.0/24
iptables -t nat -A POSTROUTING -s 5.6.7.0/24 -j NETMAP --to 1.2.3.0/24

---

The TTL patch:
Author: Harald Welte
Status: Stable, needs new checksum handling
This adds CONFIG_IP_NF_TARGET_TTL option, which enables the user to set the TTL value of an IP packet or to increment / decrement it by a given value.

---

The iplimit patch:
Author: Gerd Knorr
Status: ItWorksForMe[tm]

This adds CONFIG_IP_NF_MATCH_IPLIMIT match allows you to restrict the number of parallel TCP connections to a server per client IP address (or address block).

Examples:

# allow 2 telnet connections per client host iptables -p tcp --syn --dport 23 -m iplimit --iplimit-above 2 -j REJECT

# you can also match the other way around: iptables -p tcp --syn --dport 23 -m iplimit ! --iplimit-above 2 -j ACCEPT

# limit the nr of parallel http requests to 16 per class C sized # network (24 bit netmask) iptables -p tcp --syn --dport 80 -m iplimit --iplimit-above 16 --iplimit-mask 24 -j REJECT

---

The random patch:
Author: Fabrice MARIE
Status: Works For Me.

This option adds CONFIG_IP_NF_MATCH_RANDOM, which allow you to match packets randomly following a given probability.

Suppported options are:

[--average] percent will match randomly packets with a probability of 'percent' default is 50%

---

The string patch:
Author: Emmanuel Roger
Status: Working, not with kernel 2.4.9
This patch adds CONFIG_IP_NF_MATCH_STRING which allows you to match a string in a whole packet.

---
and iptables 1.2.5 , wich I haven't compiled yet, so cannot tell for sure, has something that seems to be awesome... New quota match to have fixed IP quotas

Detailed instructions, Using mdk 8.1

[hack0rama]

Pleasee see my page [hackorama.com] with detailed instructions on how I did port forwarding on my Mandrake 8.1 box, which uses Bastille scripts to generate the Iptable rules.

SOCKS

[redcliffe]

Anyone tried using a transparent SOCKS proxy for this task? I know there is one in Debian, but does anyone know how well it works? I'd basically like to be able to get Netmeeting and P2P to work from behind my firewall when I'm trying to connect to someone else who's behind a firewall. Thanks,

David

Re:SOCKS

[sirsnork]

Seems to work quite well. I've used it for ICQ, IRC and various other things. Nothing overly intensive mind you.

Re:SOCKS

[redcliffe]

Is there a good HOWTO for setting it up with 2.4 somewhere? Thanks,

David

Here's Mine

[jchawk]

What there aren't enough of is plan old examples. Here is my configuration. xxx's replace personal info. :)

iface eth1 inet static
address 209.195.xxx.xxx
netmask 255.255.255.224
gateway 209.195.xxx.xxx

iface eth0 inet static
address 10.10.10.1
netmask 255.255.255.0
network 10.10.10.0
broadcast 10.10.10.255
up /sbin/iptables -t nat -F
up /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 2021 -j DNAT --to 10.10.10.2:21
up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 2022 -j DNAT --to 10.10.10.2:22
up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 2080 -j DNAT --to 10.10.10.2:80
up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 33022 -j DNAT --to 10.10.10.33:22
up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 33021 -j DNAT --to 10.10.10.33:21
up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 25022 -j DNAT --to 10.10.10.25:22
up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 5800 -j DNAT --to 10.10.10.3:5800
up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 5900 -j DNAT --to 10.10.10.3:5900
up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 5801 -j DNAT --to 10.10.10.2:5801
up /sbin/iptables -t nat -A PREROUTING -p tcp --dport 5901 -j DNAT --to 10.10.10.2:5901

gShield is very good

[sharkey]

gShield [linuxmafia.org] is a nice package that uses well-commented config files and scripts to setup an iptables firewall. Quote from page:

support for multiple NATs, configurable public service access, access control lists, routable protection, DMZ support, port-forwarding, MAC-specific filtering, configurable outgoing filtering, blacklists, support for transparent proxy, QoS marking of common transports and more.

I use it at work and at home. One caveat since you are using Mandrake: gShield.rc is not a SysVinit script, so /sbin/ntsysv (or whatever SysVinit config tool you are using)will not be able to configure it into runlevels without modification. Personally, I am running it out of rc.local.