Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm running 3 virtual machines with Fedora 19. The machine B is set up with two networks adapters and provides que channel between machine A and machine C.

The machine A IP is set to 192.168.1.1 and machine C IP is set to 172.16.1.1. On machine B I have one adapter with IP 192.168.1.254 and another adapter with IP 172.16.1.254.

I've created this rule in machine B (it's working as a router):

iptables -P INPUT DROP

iptables -A INPUT -p icmp -j ACCEPT

And so, no connections between the machines are made unless the PING that allows the communication between machine A and B.

Now I want to create a rule in the router that allows the communication of HTTPS between the external network (machine C) and the internal network (machine A)

I've added this rule in machine B:

iptables -A FORWARD -o p7p1 -p tcp --dport 443 -d 192.168.1.1 -j ACCEPT

Where p7p1 is the interface on machine B that connects to machine A. I've also tried:

iptables -A FORWARD -i p8p1 -o p7p1 -p tcp --dport 443 -d 192.168.1.1 -j ACCEPT

Where p8p1 is the interface on machine B that connects to machine C.

Now, on machine A I do nc -l 443 and on machine C nc 192.168.1.1 443 but I'm getting Ncat: Connection timed out

Whats wrong with my rule?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You are missing a rule that also allows the answers to go through your firewall.

I trust the code for netfilter and its powerful state module, so i'd use iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT so that also the packets in the other direction are allowed as well.

In your ruleset the answers from 192.168.1.1 to the other machine at 172.16.1.1 are blocked.

Also see documentation for iptables troubleshooting, for example this on linuxhomenetworking.com and add logging rules when things are not working.

iptables -A FORWARD -j LOG
share|improve this answer
    
Thanks for your answer –  Favolas Oct 28 '13 at 20:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.