IPTables and Port Forwarding?

$hy_guy asks: "I have been totally striking out finding some info on how to do port forwarding in Linux. I am currently running Mandrake 8.1 as my router and i would like to forward a particular port to another machine on my LAN. I'm pretty sure I have to use iptables but I have been very unsuccesful at the proper syntax. I have scoured through Google and I have not really found any useful info. I would appreciate just a link or something to point me the correct direction. Thanks for the help" I know many of you may think this is an FAQ, but it seems that IPTables confuses many people as this is not the first time this question has hit the bin. If someone has a good general reference on the use of IPTables, please share.

Comments

Check MonMotha's IPTables scripts...

[Evro]

I use MonMotha's IPTables script to build my firewall. You tell it which ports to leave open and it closes the rest. It also has stuff in there for rate limiting and stuff, I think. According to that page, the beta does port forwarding.

Docs abound

[jmd!]

Netfilter is extremely well documented... this poster must not have tried very hard.

Home page: http://www.netfilter.org/

FAQs: http://www.netfilter.org/documentation/FAQ/netfilt er-faq.html

Excellent HOWTOs: http://www.netfilter.org/documentation/index.html# HOWTO

google and howto

[gus goose]

So, I Googled, then chose the 2.4 NAT Howto, Section 6.2

Why is that so hard?

gus

Re:google and howto

[Raptor CK]

It seems simple, but I'll bet that today's kids forget to use "howto" as a search parameter.

Go ahead, Google "iptables port forwarding" and see how much worse those results are.

This just goes to show that we need more basic user education. RTFM should be preceded by RTFH (Read The Fucking HOWTO!) so that people at least know what to look for when they're stumped.

Kids these days...

pffff

[Smoking]

This one's a bit easy:

Step one: go to http://www.netfilter.org

step two: find the HOWTO section

step three: fifth line of the HTML version of the NAT-HOWTO reads like this: This document describes how to do masquerading, transparent proxying, port forwarding, and other forms of Network Address Translations with the 2.4 Linux Kernels.

step four:Wait, there's no step four... there's no step four!

Quentin

'tis Quite Easy

[Jester998]

Heh... by coincidence, I just finished a project for the local hospital... I was coding a full-featured firewall based on Linux, and it had to integrate seamlessly with a WinNT network, including limiting 'net access by user name, and it had to work totally transparently for the users. Since a number of people in the hospital use Remotely Anywhere to connect from home, port forwarding became an issue for us.

The syntax for port forwarding is:

iptables -t nat -I PREROUTING -p <protocol> --dport <destination port> -j DNAT --to-destination <destination IP>:<destination port>

Note that you can remap port numbers, too, if need be (ie. traffic coming in on port 80 is redirected internally to port 5000).

Make sure you have the destination NAT target compiled in (I think it might be, by default), and make sure you enable all the NAT stuff you need.

Linux advanced routing how-to

[eufaula]

if you want to get into the kernel's routing abilities, check http://ds9a.nl/lartc/HOWTO//cvs/2.4routing/output/ 2.4routing.html. this site is _the_ place to go for info on the subject. But if you want to keep it simple, stay with the suggested netfilter sites.

Here's how

[jquirke]

Yeah it's not as obvious as first, but it's actually pretty simple.

OK here's an example: our gateway is 192.168.0.1 with lan interface eth0 and internet interface eth1. We want to redirect port 21 (FTP) to the machine 192.168.0.10

First of all, we need to add a rule matching incoming data to port 21. We use the PREROUTING chain in the NAT table:

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 21 -j DNAT --to-destination 192.168.0.10

This says: in the network address translation table and the chain that deals with incoming data prior to routing, and if the data is coming in from the internet and wants to go to TCP port 21 (ftp), DNAT (destination network address translate) it to transparently make it go to 192.168.0.10

Here's a generic template:

iptables -t nat -A PREROUTING -i [net interface] [selection rules - proto, port] -j DNAT --to-destination [ip on lan]

You can also redirect to a different port number, in the above example to redirect to 192.168.0.10 port 321 it would be:

--to-destination 192.168.0.10:321

As for this being an FAQ, I am aware of no such references on IPTables, and it doesn't matter. I think the manual page provides more than sufficient information to get you started. If you don't understand it, then you should not be administering a gateway of any kind!

Re:Here's how

[man_ls]

Well written. I saved this comment as a text file in case I'll ever need to use it.

My setup...

[kilgore_47]

I spent a while fooling with various IPTables scripts, but finnally settled on the gpl'd shorewall package.

It handles all my iptables configuration, including NAT with port forwarding.

FwBuilder ROCKS !

[Bitsy Boffin]

If you have X running, not necessarily on your firewall (you just use fwbuilder to "compile" a script and run the script on the firewall box) then I can heartily recommend fwbuilder.

It's a totally object based graphical tool for building a firewall. You can just drag and drop "services" (ports) to create port mappings, drap and drop machines, other firewalls, networks, etc to determin who gets to do what.

Has a nice little druid in it to get you a working setup that you can modify to better suit your needs.

Really. Check it out.

Re:Limiting access by username

[Lord Sauron]

He apparently did it by IP address.
But there's another way:

owner
This module attempts to match various characteristics of the packet creator, for locally-generated packets. It is only valid in the OUTPUT chain, and even this some packets (such as ICMP ping responses) may have no owner, and hence never match.

--uid-owner userid
Matches if the packet was created by a process with the given effective user id.

--gid-owner groupid
Matches if the packet was created by a process with the given effective group id.

--pid-owner processid
Matches if the packet was created by a process with the given process id.

--sid-owner sessionid
Matches if the packet was created by a process in the given session group.
And with Iptables 1.2.5 you can even establish quotas per user.

Detailed instructions, Using mdk 8.1

[hack0rama]

Pleasee see my page with detailed instructions on how I did port forwarding on my Mandrake 8.1 box, which uses Bastille scripts to generate the Iptable rules.

Re:Linux Journal

[crow]

See http://www.linuxjournal.com/article.php?sid=3575 for another Linux Journal article on setting up a firewall with various features including port forwarding. This article predates the 2.4 kernel, so it's not relevant to iptables, but if you're running a 2.0 or 2.2 kernel, you should find an example there.

I just ran across it today when setting up a network. (You would think I would have remembered, considering that I wrote the article.)

Re:SOCKS

[redcliffe]

Is there a good HOWTO for setting it up with 2.4 somewhere? Thanks,

David

gShield is very good

[sharkey]

gShield is a nice package that uses well-commented config files and scripts to setup an iptables firewall. Quote from page:

support for multiple NATs, configurable public service access, access control lists, routable protection, DMZ support, port-forwarding, MAC-specific filtering, configurable outgoing filtering, blacklists, support for transparent proxy, QoS marking of common transports and more.

I use it at work and at home. One caveat since you are using Mandrake: gShield.rc is not a SysVinit script, so /sbin/ntsysv (or whatever SysVinit config tool you are using)will not be able to configure it into runlevels without modification. Personally, I am running it out of rc.local.