0

I'm trying to create a port forwarding rule on my linux router, I'm trying the following rules:

iptables -t nat -A PREROUTING -i $WAN -p tcp --dport 4242 -j DNAT --to-destination 192.168.2.1:22
iptables -A FORWARD -i $WAN -p tcp --dport 22 -d 192.168.2.1 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

The problem is that when I try to connect from a remote machine, the packet gets dropped by an INPUT rule according to the logs:

DROPIN>IN=ppp0 OUT= MAC= SRC=$source_ip DST=192.168.2.1 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=61883 DF PROTO=TCP SPT=57684 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0
DROPIN>IN=ppp0 OUT= MAC= SRC=$source_ip DST=192.168.2.1 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=61884 DF PROTO=TCP SPT=57684 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0

This means that I'm missing an INPUT rule? If I use an INPUT rule wouldn't I open the port globally to the internet?

Here's my whole iptables.sh just in case:

#!/usr/bin/env bash

PATH='/sbin'

WAN=ppp0
LAN=enp1s0
VLAN10=enp1s0.10
VLAN20=enp1s0.20
VLAN30=enp1s0.30

LAN_NET=192.168.2.0/24
VLAN10_NET=192.168.10.0/24
VLAN20_NET=192.168.20.0/24
VLAN30_NET=192.168.30.0/24

echo "Flushing rules"

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -Z
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

echo "Allow loopback"
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

echo "Drop invalid states"
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A OUTPUT -m conntrack --ctstate INVALID -j DROP
iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP

echo "Allow established and related connections"
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

echo "Rate limit ICMP traffic per source"
iptables -A INPUT -p icmp --icmp-type echo-request -m hashlimit --hashlimit-upto 5/s --hashlimit-mode srcip --hashlimit-srcmask 32 --hashlimit-name icmp-echo-drop -j ACCEPT

echo "Allow DHCP"
iptables -I INPUT -i $LAN -p udp -m udp --dport 67 -m conntrack --ctstate NEW -j ACCEPT
iptables -I INPUT -i $VLAN10 -p udp -m udp --dport 67 -m conntrack --ctstate NEW -j ACCEPT
iptables -I INPUT -i $VLAN20 -p udp -m udp --dport 67 -m conntrack --ctstate NEW -j ACCEPT
iptables -I INPUT -i $VLAN30 -p udp -m udp --dport 67 -m conntrack --ctstate NEW -j ACCEPT

echo "Allow SSH from LAN"
iptables -A INPUT -i $LAN -s $LAN_NET -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT

echo "Allow SSH from VLAN10"
iptables -A INPUT -i $VLAN10 -s $VLAN10_NET -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT

echo "Port forward SSH external 4242 to local 22"
iptables -t nat -A PREROUTING -i $WAN -p tcp --dport 4242 -j DNAT --to-destination 192.168.2.1:22
iptables -A FORWARD -i $WAN -p tcp --dport 22 -d 192.168.2.1 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

echo "Allow DNS (UDP and TCP for large replies)"
iptables -A INPUT -i $LAN -s $LAN_NET -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $LAN -s $LAN_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN10 -s $VLAN10_NET -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN10 -s $VLAN10_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN20 -s $VLAN20_NET -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN20 -s $VLAN20_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN30 -s $VLAN30_NET -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN30 -s $VLAN30_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT

echo "Drop external DNS"
iptables -A FORWARD -o $WAN -i $LAN -s $LAN_NET -p udp --dport 53 -m conntrack --ctstate NEW -j DROP
iptables -A FORWARD -o $WAN -i $LAN -s $LAN_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j DROP
iptables -A FORWARD -o $WAN -i $VLAN10 -s $VLAN10_NET -p udp --dport 53 -m conntrack --ctstate NEW -j DROP
iptables -A FORWARD -o $WAN -i $VLAN10 -s $VLAN10_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j DROP
iptables -A FORWARD -o $WAN -i $VLAN20 -s $VLAN20_NET -p udp --dport 53 -m conntrack --ctstate NEW -j DROP
iptables -A FORWARD -o $WAN -i $VLAN20 -s $VLAN20_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j DROP
iptables -A FORWARD -o $WAN -i $VLAN30 -s $VLAN30_NET -p udp --dport 53 -m conntrack --ctstate NEW -j DROP
iptables -A FORWARD -o $WAN -i $VLAN30 -s $VLAN30_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j DROP

echo "Drop external DoT"
iptables -A FORWARD -o $WAN -i $LAN -s $LAN_NET -p tcp --dport 853 -m conntrack --ctstate NEW -j DROP
iptables -A FORWARD -o $WAN -i $VLAN10 -s $VLAN10_NET -p tcp --dport 853 -m conntrack --ctstate NEW -j DROP
iptables -A FORWARD -o $WAN -i $VLAN20 -s $VLAN20_NET -p tcp --dport 853 -m conntrack --ctstate NEW -j DROP
iptables -A FORWARD -o $WAN -i $VLAN30 -s $VLAN30_NET -p tcp --dport 853 -m conntrack --ctstate NEW -j DROP

echo "Enable network address translation"
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
iptables -A FORWARD -o $WAN -i $LAN -s $LAN_NET -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -o $WAN -i $VLAN10 -s $VLAN10_NET -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -o $WAN -i $VLAN20 -s $VLAN20_NET -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -o $WAN -i $VLAN30 -s $VLAN30_NET -m conntrack --ctstate NEW -j ACCEPT

echo "Enable TCP MSS clamping"
iptables -t mangle -A FORWARD -o $WAN -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

echo "Do not reply with Destination Unreachable messages"
iptables -A OUTPUT -p icmp --icmp-type destination-unreachable -j DROP

echo "Log all dropped packets"
iptables -A INPUT -m limit --limit 1/sec -j LOG --log-level debug --log-prefix 'DROPIN>'
iptables -A OUTPUT -m limit --limit 1/sec -j LOG --log-level debug --log-prefix 'DROPOUT>'
iptables -A FORWARD -m limit --limit 1/sec -j LOG --log-level debug --log-prefix 'DROPFWD>'

Thanks in advance for any help!

0

I don't think you need an INPUT rule since traffic should flow to another box.

Just to debug, have you tried same rules with -I instead of -A? Does it work that way? If so, you should have some general FORWARD rule before, not allowing the particular one.

New contributor
realpclaudio is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.