NAT loopback on my router

Question

Tried all for a day still can't get it done.

I am trying to configure 'NAT loopback' on my router.

• Router LAN IP: 192.168.1.254 (br0)
• Router WAN IP: 192.168.10.129
• Web-server LAN IP: 192.168.1.1

I am trying to access the web-server running on 192.168.1.1 from 192.168.1.2.

If this done. i would try to access the same from WAN to LAN i.e. i will connect another router in my office network and from the client of 2nd router i would like to access the same web-server page.

Default iptables list before configuring:

# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
           all  --  anywhere             224.0.0.0/24

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  192.168.1.0/24       anywhere
MASQUERADE  all  --  192.168.1.0/24       anywhere

I tried below iptables rules:

iptables -t nat -I PREROUTING -i br0 -s 192.168.1.0/24 -d 192.168.10.129/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.1
iptables -t nat -I POSTROUTING -o br0 -s 192.168.1.0/24 -d 192.168.1.1/32 -p tcp -m tcp --dport 80 -j SNAT --to-source 192.168.1.254

Answer 1

[SOLVED]

Tested and okey..!

Dynamic values:

WAN Interface: vlan10 LAN Interface: br0

LAN Web server IP: 192.168.1.1 LAN Web server Port: 8080

Router WAN IP: 192.168.10.129 Router LAN IP: 192.168.1.254

1. port-forwarding rules

iptables -I FORWARD 1 -i vlan10 -p tcp -d 192.168.1.1 --dport 8080 -j ACCEPT 
iptables -A PREROUTING -t nat -i vlan10 -p tcp --dport 8080 -j DNAT --to 192.168.1.1

2. nat-loopback rules

iptables -t nat -A PREROUTING -i br0 -s 192.168.1.0/24 -d 192.168.10.129/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.1.1
iptables -t nat -A POSTROUTING -o br0 -s 192.168.1.0/24 -d 192.168.1.1/32 -p tcp -m tcp --dport 8080 -j SNAT --to-source 192.168.1.254

NOTE: Remember to disable the other network LAN interface while testing..