Port forwarding

[KUCKAERTZ Régis - NVISION]

> if that's your only FORWARD rule, and the POLICY of FORWARD 
> is set to DROP--you're not allowing reply packets back 
> through the machine (SYN's will get through, but SYN-ACK's 
> will be blocked).
> 
>   iptables -I FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> 
> would help in this situation.

Did it, but nothing changed

> um--where are you telnet-ing from, and where are you tcdump-ing at?

I'm telnet'ing on a different host (otherwise I would have set the
appropriate rule in the OUTPUT chain), but I do the dump on the "gateway"

>   $TCPDUMP host $MASK_IP and port $MASK_PORT
> 
> is equivalent to what you're trying to capture.

Thanks!!

> if your BPF specifies $MASK_IP and $MASK_PORT why is your 
> capture showing $REAL_IP and $REAL_PORT?  those packets 
> shouldn't even match the filter...

Maybe that's because I do the dump on the same machine that does the DNAT?

I hope what follows will help you spot my mistake!

Régis

$ iptables -vnxL -t nat; iptables -vnxL -t mangle; iptables -vnxL

# nat table
Chain PREROUTING (policy ACCEPT 2439 packets, 148991 bytes)
    pkts      bytes target     prot opt in     out     source
destination         
      17       1020 DNAT       tcp  --  *      *       0.0.0.0/0
$MASK_IP         tcp dpt:$MASK_PORT to:$REAL_IP:$REAL_PORT 

Chain POSTROUTING (policy ACCEPT 741 packets, 45651 bytes)
    pkts      bytes target     prot opt in     out     source
destination         
       0          0 SNAT       tcp  --  *      *       0.0.0.0/0
$REAL_IP         tcp dpt:$REAL_PORT to:$MASK_IP 

Chain OUTPUT (policy ACCEPT 741 packets, 45651 bytes)
    pkts      bytes target     prot opt in     out     source
destination         

# mangle table
Chain PREROUTING (policy ACCEPT 1567265 packets, 1105330580 bytes)
    pkts      bytes target     prot opt in     out     source
destination         

Chain OUTPUT (policy ACCEPT 1181535 packets, 615648770 bytes)
    pkts      bytes target     prot opt in     out     source
destination         

# filter table
Chain INPUT (policy ACCEPT 44233 packets, 9251612 bytes)
    pkts      bytes target     prot opt in     out     source
destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source
destination         
       0          0 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED 
       0          0 ACCEPT     tcp  --  *      *       0.0.0.0/0
$REAL_IP           tcp dpt:$REAL_PORT

Chain OUTPUT (policy ACCEPT 41927 packets, 30331854 bytes)
    pkts      bytes target     prot opt in     out     source
destination