IPTables Prerouting

Applications IP Networking
1

Hi ,

My route looks like below:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.253   192.168.1.210   255.255.255.255 UGH   0      0        0 eth2
203.6.21.111   0.0.0.0         255.255.255.252 U     0      0        0 eth0
192.168.3.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth2
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth2
0.0.0.0         203.6.21.112   0.0.0.0         UG    0      0        0 eth0

Observe LAN 192.168.1.253 which goes via 192.168.1.210

Now here is my prerouting rule

iptables -t nat -A PREROUTING -p tcp -i eth0 -d 203.6.21.111 --dport 8001 -j DNAT --to 192.168.1.104:80

When I hit url http://203.6.21.111:8001 - it is not redirecting to mentioned ip and port.. I'm not sure what else am I missing here..

[root@lead ~]# ping 192.168.1.104
PING 192.168.1.104 (192.168.1.104) 56(84) bytes of data.
64 bytes from 192.168.1.104: icmp_seq=1 ttl=128 time=2.66 ms
64 bytes from 192.168.1.104: icmp_seq=2 ttl=128 time=0.725 ms

--- 192.168.1.104 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 0.725/1.693/2.661/0.968 ms
[root@lead ~]# traceroute 192.168.1.104
traceroute to 192.168.1.104 (192.168.1.104), 30 hops max, 40 byte packets
 1  192.168.1.104 (192.168.1.104)  3.060 ms  2.996 ms  2.965 ms

[root@lead ~]# telnet 192.168.1.104 80
Trying 192.168.1.104...
Connected to 192.168.1.104 (192.168.1.104).
Escape character is '^]'.
^]

Thanks
ashok

2

Just reading the man page, but don't you need symmetrical rules to allow packets to flow both ways and make a tcp connection? Man Page for iptables (linux Section 8) - The UNIX and Linux Forums After your tcp syn packet gets there, the tcp syn ack has to have a path back.

Pre is for packets outgoing from inside-net, post is for packets incoming from outside-net, and output is for locally gen packets. For a firewall host, one seems to need reciprocal Pre and Post, and for a local only client firewall, output and post.