Re: iptables

Hey-

Looks like you're not actually forwarding the port...

try adding

DNAT       tcp  --  anywhere             anywhere           tcp dpt:80 to:192.168.1.10:22

which looks like:

-A PREROUTING -p tcp -m tcp -i eth0 --dport 80 -j DNAT --to-destination 192.168.1.23:80

in your /etc/sysconfig/iptables file



Pete

On Fri, 21 Mar 2003, Eduardo wrote:

> Hi,
>
> It is like the Masquerading is not working, can somebody help me ?
> My network is as follow (changing its IP), I can get "http" web page
> of 192.168.1.23 requesting it from 192.168.0.222
> but when I try to get the web page of 192.168.1.23 from INTERNET
> I get a 500 TimeOut answer, verifying network state on
> the real server I see the request stopped on SYN_RECV
>
> tcp        0      0 192.168.1.23:80         192.168.0.111:1532      SYN_RECV
>
>  - x - x - x  - x - x - x  - x - x - x  - x - x - x  - x - x - x  - x - x - x
>
>                           I N T E R N E T
>
>
>                                     |  eth0 : 192.168.0.222       eth0:1 192.168.0.220 (virtual server IP)
>                      |---------------------------|
>                      |     router              |
>                      |---------------------------|
>                                     |  eth1 : 192.168.1.2
>               -------------------------------------------------            gateway eth1:1 192.168.1.21
>                                     |
>                                     |
>                                     |  eth0 : 192.168.1.23
>                      |---------------------------|
>                      |     real server 1    |
>                      |---------------------------|
>
>  - x - x - x  - x - x - x  - x - x - x  - x - x - x  - x - x - x  - x - x - x
> router server
> >iptables -t nat -L
> Chain PREROUTING (policy ACCEPT)
> target     prot opt source               destination
>
> Chain POSTROUTING (policy ACCEPT)
> target     prot opt source               destination
> MASQUERADE  all  --  192.168.1.0/24       anywhere
> LOG        all  --  anywhere             anywhere           LOG level warning
>
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
>
>  - x - x - x  - x - x - x  - x - x - x  - x - x - x  - x - x - x  - x - x - x
>
> Real server 1
>
> >netstat
> tcp        0      0 192.168.1.23:80         192.168.0.111:1532      SYN_RECV
>
> >route
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
> 192.168.1.0     *               255.255.255.0   U     0      0        0 eth0
> 127.0.0.0       *               255.0.0.0       U     0      0        0 lo
> default         192.168.1.21    0.0.0.0         UG    0      0        0 eth0
>
> >ifconfig
> eth0      Link encap:Ethernet  HWaddr xxxxxxxxx
>           inet addr:192.168.1.23  Bcast:192.168.1.255  Mask:255.255.255.0
>
> Thank you,
>
> Eduardo.
>