I recently got and setup a small linux (Debian) router box. I'm adding it to an existing network to create a small subnet with specific properties, namely internet content filtering. I'm highjacking http/https (80/443) traffic and pushing it through filtering services running on the box with:
$IPT -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 8080
$IPT -t nat -A PREROUTING -i eth1 -p tcp --dport 443 -j REDIRECT --to-port 8080
While this works properly (when the client machines know about the https proxy) I can't get non-browser applications to work, namely the Steam client. It is supposed to use a range of TCP and UDP ports. I've tried making ACCEPT rules for those ranges for both TCP and UDP and for both dport and sport connections with no success.
Am I misunderstanding something about routing? I assume that I don't have to port forward anything because I'm the client, consuming their ports. I thought I just had to permit traffic on ports and that it would then forward along to the server endpoint and come back. Does anyone know how to allow the Steam client (or all traffic on all ports) in iptables?
SECOND EDIT (different code):
Based on comments I decided to try and update my script, taking out different lines I was trying and just making it accept everything. However it still doesn't seem to work, at least for Steam. This is my raw code without me trying to clean it up for this site, maybe I missed something when I did that.
#!/bin/sh
IPT=/sbin/iptables
# Flush all chains, to start with a clean slate.
$IPT -F
$IPT -t nat -F
# Set filter Policies. By default, ACCEPT everything.
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
# Set server INPUT rules.
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -i eth1 -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
$IPT -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT
# Attempt to blanket statement accept everything (all ports, essentially)
$IPT -A INPUT -p tcp -m tcp --dport 0:65000 -j ACCEPT
$IPT -A INPUT -p udp -m udp --dport 0:65000 -j ACCEPT
$IPT -A FORWARD -p tcp -m tcp --dport 0:65000 -j ACCEPT
$IPT -A FORWARD -p udp -m udp --dport 0:65000 -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 0:65000 -j ACCEPT
$IPT -A OUTPUT -p udp -m udp --dport 0:65000 -j ACCEPT
# Accept minecraft, this is working
$IPT -A INPUT -p tcp -m tcp --dport 25565 -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp --dport 25565 -j ACCEPT
$IPT -A FORWARD -p tcp -m tcp --dport 25565 -j ACCEPT
# Set router FORWARD rules.
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i eth1 -o eth0 -j ACCEPT
# Masquerade outgoing LAN traffic.
$IPT -t nat -A POSTROUTING -s 172.16.1.0/24 -o eth0 -j MASQUERADE
$IPT -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 8080
$IPT -t nat -A PREROUTING -i eth1 -p tcp --dport 443 -j REDIRECT --to-port 8080
# Port forward minecraft, simple enough
$IPT -t nat -A PREROUTING -i eth0 -p tcp --dport 25565 -j DNAT --to-destination 172.16.1.100