Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Using iptables on my router (dd-wrt), I'd like to forward requests to the router on port 64738 from the LAN to an IP (192.168.10.14) on the WAN. This is the opposite of the norm (forwarding a request from the WAN to and IP on the LAN) and I can't get it work. Here's what I think should work (but doesn't):

root@DD-WRT:~# iptables -t nat -A PREROUTING -p tcp -i vlan0 --dport 64738 -j DNAT --to-destination 192.168.10.14:64738
root@DD-WRT:~# iptables -t nat -A PREROUTING -p udp -i vlan0 --dport 64738 -j DNAT --to-destination 192.168.10.14:64738
root@DD-WRT:~# iptables -A FORWARD -p tcp -d 192.168.10.14 --dport 64738 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
root@DD-WRT:~# iptables -A FORWARD -p udp -d 192.168.10.14 --dport 64738 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

But a connection attempt (the router's IP here is 192.168.9.2) fails:

# nmap -p 64738 192.168.9.2

Starting Nmap 6.40 ( http://nmap.org ) at 2013-10-05 22:21 EDT
Nmap scan report for rr-netgear.501s.lyndrew.com (192.168.9.2)
Host is up (0.00024s latency).
PORT      STATE  SERVICE
64738/tcp closed unknown
MAC Address: 4C:60:DE:FF:7E:88 (Netgear)

Note, hitting the actual WAN IP works fine:

# nmap -p 64738 192.168.10.14

Starting Nmap 6.40 ( http://nmap.org ) at 2013-10-05 22:21 EDT
Nmap scan report for raspi01.dmz.501s.lyndrew.com (192.168.10.14)
Host is up (0.0091s latency).
PORT      STATE SERVICE
64738/tcp open  unknown

What should I be doing?

share|improve this question

migrated from serverfault.com Oct 6 '13 at 2:27

This question came from our site for professional system and network administrators.

    
Not using NAT would be a good starting point. –  Michael Hampton Oct 6 '13 at 2:27
add comment

2 Answers

Breakdown the issues first:

  1. you need it to do both TCP and UDP ?
  2. Did you set NAT for both direction ? (forward route + backward route)
  3. turn off the filtering first. (use accept all rules)

Also, dump the full iptables so we can help you

iptables -L

ps: i didn't see any backward route here, guess that why it didn't work

share|improve this answer
    
thinking how you ping from LAN to WAN, when the packet reach the router, you have change the destination (DNAT) so the message can forward to the destination, but the source ip didn't change, so, at destination, it will not know how to sent the reply back. –  Antony Lee Oct 6 '13 at 3:46
add comment

This worked:

iptables -t nat -A PREROUTING -i br0 -p tcp -d 192.168.9.2 --dport 64738 -j DNAT --to-destination 192.168.10.14:64738
iptables -t nat -A PREROUTING -i br0 -p udp -d 192.168.9.2 --dport 64738 -j DNAT --to-destination 192.168.10.14:64738
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.