1

I'm setting up an Ubuntu 11.10 server to act as firewall for a network running several different SSL websites. The idea is fairly common: have all public IP's for each site aliased to the public interface on the firewall and use iptables/NAT to forward connections in to the web servers. I'm having a devil of a time getting this fairly simple thing to work though.

Say I have a public-facing interface on the firewall:

eth0 25.25.25.25

And I want to alias a new IP to that public interface:

ifconfig eth0:0 25.25.25.26

I then see the interface is created and I can ping it from other hosts. So far so good. Now I have my web server sitting on the DMZ side of the network, accessible by the firewall but not the public. Let's say the internal web server is 172.16.2.1. So I create a NAT rule as follows:

iptables -t nat -A PREROUTING -i eth0 -d 25.25.25.26 -j DNAT --to-destination 172.16.2.1

It just doesn't want to work. If I run tcpdump on the public interface, it will see the incoming traffic, but iptables just won't NAT it to the destination.

It will work fine if I use a non-aliased IP, such as 25.25.25.25. I've read that iptables doesn't like working with virtual interfaces and ignores them. That's fine, but it should still be working with "eth0" instead of "eth0:0". In my case, iptables does not complain if I try to use "eth0:0" but it doesn't make any difference.

I've been using OpenBSD for a long time now, so I'm comfortable setting this same thing up with pf. But years ago I used to do this with a RedHat box and it worked just fine. Has something changed? There has to be a way to do this. I've seen several examples from other folks saying that you just need to make sure you specify the main device (eth0) instead of using eth0:0. But I've got nothing.

Oh, and to rule out that this is just a filtering problem, I've completely disabled all filter rules:

iptables -F
iptables -X
iptables -P FORWARD ACCEPT
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT

Any ideas? I'm certainly no newbie when it comes to iptables, but this problem is starting to make me feel like one.

2 Answers 2

2

When you use virtual interfaces just use the option -d (destination), ignoring the option -i (interface)

Instead of:
iptables -t nat -A PREROUTING -i eth0 -d 25.25.25.26 -j DNAT --to-destination 172.16.2.1

use:
iptables -t nat -A PREROUTING -d 25.25.25.26 -j DNAT --to-destination

Work with iptables v1.4.14 in Debian

-1

Most likely you'll need to use forward chain and do not provide input interface for that:

iptables -t nat -A PREROUTING -i eth0 -d 25.25.25.26 -j DNAT --to-destination 172.16.2.1

Try it this way:

iptables -t nat -A FORWARD -d 25.25.25.26 -j DNAT --to-destination      172.16.2.1

This works for me both on Debian/Ubuntu and iptables-based routers like MikroTik too. You can also take a look here about port forwarding, it can be helpful too.

2
  • The FORWARD chain is not part of the nat table. Your proposed 'correction' will not be accepted by iptables -- it will give you an error message instead.
    – Larssend
    Feb 15, 2017 at 7:19
  • Also, DNAT is only valid for PREROUTING and OUTPUT chains. Please avoid recommending anything that you don't really know.
    – Larssend
    Feb 15, 2017 at 7:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .