DNAT Rules.

[Jörg Harmuth]

Vincent Blondel wrote:
> Hi,
> 
> I am trying to configure next set up so a public host can connect to my web server located in a dmz.
> 
>                   -----------------------
>   public host --> |  eth1        eth2   | -->  web server
>     x.x.x.x       | 1.2.3.4    10.1.1.1 |      10.1.1.2:80
>                   ----------------------
> 
> As far as I can understand, this typically corresponds to a mix of DNAT, SNAT and FORWARD rules. Below you can find the
> rules I have configured until now.
> 
> #####################################################################
> 
> # Enable ip forward
> echo 1 > /proc/sys/net/ipv4/ip_forward
> 
> # Unlimited traffic on the loopback interface
> iptables -A INPUT  -i lo -j ACCEPT
> iptables -A OUTPUT -o lo -j ACCEPT

Ok, until here.

> # Set the default policy to drop
> iptables --policy INPUT   DROP
> iptables --policy OUTPUT  DROP
> iptables --policy FORWARD DROP

This is more a philosophical question and is discussed on this list 
again and again. My opinion is to have a OUTPUT policy of ACCEPT and 
then dedicated DROP Rules where needed.

> iptables -t nat --policy PREROUTING  DROP
> iptables -t nat --policy OUTPUT      DROP
> iptables -t nat --policy POSTROUTING DROP
> 
> iptables -t mangle --policy PREROUTING  DROP
> iptables -t mangle --policy POSTROUTING DROP

Don't do that. Don't filter in nat and mangle. These tables are not 
intended for filtering.

> iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 1.2.3.4

Yes.

> iptables -t nat -A PREROUTING -i eth1 -p tcp --sport 1024:65535 -d 1.2.3.4 --dport 80 -j DNAT --to-destination 10.1.1.2
> iptables -A FORWARD -i eth1 -o eth2 -p tcp --sport 1024:65535 -d 10.1.1.2 --dport 80 -m state --state NEW -j ACCEPT

I prefer to add --syn to the FORWARD rule.

> iptables -A FORWARD -i eth2 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A FORWARD -i eth1 -o eth2 -m state --state ESTABLISHED,RELATED -j ACCEPT

These two rules can be rewritten to

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

It is not working because you set policies in mangle to DROP and there 
is no rule, that allows packets to pass mangle. But even if you add 
respective rules (or preferably set policies to ACCEPT) in mangle, it 
will probably not work, because nat/POSTROUTING has only a rule for 
outgoing packets via eth1. So the incoming SYN packet will be dropped, 
effectively terminating the connection.

HTH,

Joerg