Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have rackspace account and wish to have this sort of setup:

Firewall/Gateway

eth0 - Public IP (56.X.X.X)

eth1 - Private IP (10.X.X.X)

Ubuntu 10.10. Accepts connections from the internet and routes port 80 to node1 (10.x.x.x)

node1

eth0 - Disabled Public IP (56.X.X.X)

eth1 - Private IP (10.X.X.X)

Ubuntu 10.10. This server is the web server.

Question:

I have searched over and over on how to achieve this and I'm not certain the steps I need to take. Rackspace gives these IPs to me, I don't control (at this point) what the IP's are for these nodes but they each have a Public IP on eth0, and Private IP on eth1.

How can I successfully forward port 80 requests from the Firewall/Gateway to node1?

Here are my iptables settings

# Generated by iptables-save v1.4.4 on Fri Jun 17 18:09:39 2011
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [1:452]
:POSTROUTING ACCEPT [1:452]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.182.33.191:80 
COMMIT
# Completed on Fri Jun 17 18:09:39 2011
# Generated by iptables-save v1.4.4 on Fri Jun 17 18:09:39 2011
*filter
:INPUT ACCEPT [154:11452]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [81:9672]
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT 
COMMIT
# Completed on Fri Jun 17 18:09:39 2011
share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

You appear to be missing a masquerade in the routers POSTROUTING table!

This is a very simplified version of my own forwarding rules on my ASUS EEEPC acting as router for my wired and wireless networks. I won't guarantee that this will work, because I edited it online here, but I hope it helps. A perfect set of rules is a very complicated and individual thing! My iptables contains about 25000 variable rules, mainly to stop spam on port 25 from unwanted countries during peak periods.

There are loads more rules that you should add to keep traffic down to only that which is necessary. Block outgoing traffic too, such as broadcasts, dhcp, mDNS etc. mDNS on port 5353 is a big offender there. Running tcpdump on an ISP's internal network makes you wonder how on Earth any real traffic has space to move!

I added a rule to stop irritating ssh brute attacks too... :-)

Add a rule for your home ip address to override all others in case you saw off the branch you're sitting on, but when making changes, better to try a timed test and fallback to a working config after 5 seconds, eg:

# ./testfirewall.sh; sleep 10;./firewall.sh

Oh the router:

#!/bin/sh
IPT=/usr/sbin/iptables;
EXTIF=eth0;
INTIF=eth1;
EXTADDR=56.X.X.X;
NODEADDR=10.182.33.191;
HI_PORTS=1024:65535

$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -P INPUT  DROP
$IPT -P OUTPUT ACCEPT
$IPT -t filter -P FORWARD DROP

# useful limit ssh attempts
$IPT -N SSH_Brute_Force
$IPT -A SSH_Brute_Force -m recent ! --rcheck --seconds 60 --hitcount 2 --rttl --name SSH -j RETURN
$IPT -A SSH_Brute_Force -j LOG --log-prefix "SSH Scan Reject: "
$IPT -A SSH_Brute_Force -j DROP


# dnat
$IPT -t nat    -A PREROUTING -i $EXTIF -p tcp -d $EXTADDR --sport $HI_PORTS --dport 80 -j DNAT --to-destination $NODEADDR:80

# forward only established connections
$IPT -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# antispoof
$IPT -t filter -A FORWARD -i $EXTIF -s $EXTADDR -j DROP
$IPT -t filter -A FORWARD -i $EXTIF -s 127.0.0.1 -j DROP
# forward new connections to node1 on port 80
$IPT -t filter -A FORWARD -i $EXTIF -o $INTIF -p tcp -d $NODEADDR -m state --state NEW --sport $HI_PORTS --dport 80 -j ACCEPT

# forward all outgoing connections from node1 (need more rules to prevent broadcasts/leakage/bogons/igmp/some icmps etc in and out)
$IPT -t filter -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT

# this appeared to be missing
$IPT -t nat    -A POSTROUTING -o $EXTIF -s $NODEADDR -d 0/0 -j MASQUERADE

$IPT -t filter -A INPUT -i lo -j ACCEPT
$IPT -t filter -A INPUT  -i $EXTIF -p tcp -m state --state NEW -m tcp -d $NODEADDR --dport 22 -m recent --set --name SSH -j SSH_Brute_Force
$IPT -t filter -A INPUT -i $EXTIF -p tcp -m state --state NEW -m tcp -d $NODEADDR --sport $HI_PORTS --dport 22 -j ACCEPT
#need to add this if you are sending mail
$IPT -t filter -A INPUT -i $EXTIF -p tcp -m tcp --dport 113 -j REJECT --reject-with tcp-reset

On the node, inputs should already be clean:

#!/bin/sh
IPT=/usr/sbin/iptables;
EXTIF=eth0;
INTIF=eth1;
EXTADDR=56.X.X.X;
NODEADDR=10.182.33.191;
HI_PORTS=1024:65535

$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -P INPUT  DROP
$IPT -P OUTPUT ACCEPT
$IPT -t filter -P FORWARD DROP

# useful limit ssh attempts
$IPT -N SSH_Brute_Force
$IPT -A SSH_Brute_Force -m recent ! --rcheck --seconds 60 --hitcount 2 --rttl --name SSH -j RETURN
$IPT -A SSH_Brute_Force -j LOG --log-prefix "SSH Scan Reject: "
$IPT -A SSH_Brute_Force -j DROP

$IPT -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -t filter -A INPUT -i lo -j ACCEPT
$IPT -t filter -A INPUT -i $EXTIF -p tcp -m state --state NEW -m tcp -d $NODEADDR --sport $HI_PORTS --dport 80 -j ACCEPT
$IPT -t filter -A INPUT  -i $EXTIF -p tcp -m state --state NEW -m tcp -d $NODEADDR --dport 22 -m recent --set --name SSH -j SSH_Brute_Force
$IPT -t filter -A INPUT -i $EXTIF -p tcp -m state --state NEW -m tcp -d $NODEADDR --sport $HI_PORTS --dport 22 -j ACCEPT

end

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.