IPTables and forwarding

[lnorris]

I have a machine that I want to bridge two networks. We'll say that one is on a 10.10.0.0 network and another on a 192.168.0.0 network.

eth0= internal or 10.10.0.0/24 network (ip 10.10.0.40)
eth1 = external or 192.168.0.0/24 network (ip 192.168.0.112)

I want eth1 to forward ssh and http traffic to specific servers on the 10.10.0.0 network.

So a HTTP or SSH request to 192.168.0.112 would get proxied to a machine on the 10.10.0.0 network.

For the life of me, I can't get this working. I've tried several samples scripts and different ways of doing it but no luck. I'll post one of the ways (simplest one). If someone could please tell me what I'm missing it would save the wall and my head a lot of grief. Thanks.

--------------------------------------------------

#!/bin/sh

INTERNAL="eth0"
EXTERNAL="eth1"

INTERNAL_IP="10.10.0.40"
EXTERNAL_IP="192.168.0.112"

SSH_IN_PORT="22"
SSH_OUT_PORT="22"
SSH_IP="192.168.0.110"

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

#CROSS YOUR FINGERS!!!
#iptables -t nat -A PREROUTING -p tcp -i $EXTERNAL -d $EXTERNAL_IP --dport $SSH_IN_PORT -j DNAT --to $SSH_IP:$SSH_OUT_PORT
#iptables -A FORWARD -p tcp -i $EXTERNAL -d $SSH_IP --dport $SSH_OUT_PORT -j ACCEPT

#Try with Masquerading..
iptables -t nat -A PREROUTING -d $EXTERNAL_IP -p tcp --dport $SSH_IN_PORT -j DNAT --to $SSH_IP
iptables -A FORWARD -p tcp --dport $SSH_OUT_PORT -d $SSH_IP -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -p tcp --dport $SSH_OUT_PORT -d $SSH_IP -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward

[EdmunTimberlane]

This should do it:

iptables -t nat -A PREROUTING -i $EXTERNAL -p tcp --dport $SSH_IN_PORT -j REDIRECT --to $INTERNAL_IP

[lnorris]

Thanks for your help, but it's still not working. I tried using that line in place of the one that had the "-j DNAT". I tried using it all by it's self. Nothing worked.

I did notice however that the SSH_IP was wrong in my example. It should have been a 10.10.0.0/24 IP. We'll say it's 10.10.0.70... So I also changed the --to line to read SSH_IP but did try it with internal INTERNAL_IP to with no success either.

I know it's something simple as this is really just a basic firewall with IP forwarding. I'm missing something...

So, modified with REDIRECT instead of DNAT it's:

#!/bin/sh

INTERNAL="eth0"
EXTERNAL="eth1"

INTERNAL_IP="10.10.0.40"
EXTERNAL_IP="192.168.0.112"

SSH_IN_PORT="22"
SSH_OUT_PORT="22"
SSH_IP="10.10.0.70"

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

#Forward SSH to an internal server.
#iptables -t nat -A PREROUTING -d $EXTERNAL_IP -p tcp --dport $SSH_IN_PORT -j DNAT --to $SSH_IP
iptables -t nat -A PREROUTING -i $EXTERNAL -p tcp --dport $SSH_IN_PORT -j REDIRECT --to $SSH_IP
iptables -A FORWARD -p tcp --dport $SSH_OUT_PORT -d $SSH_IP -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -p tcp --dport $SSH_OUT_PORT -d $SSH_IP -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward