1

I have a debian box with two interfaces wan and lan(192.168.0.1). On lan:80 I have a site that must be accessed from local network. Also I need this site to be accessed from wan:777. This is my iptables rules:

iptables -A INPUT -i $LAN -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i $WAN --dport 777 -j DNAT --to-destination 192.168.0.1:80
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

However, it doesn't work. It works only if I remove -i $LAN fron INPUT. I mean this way:

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i $WAN --dport 777 -j DNAT --to-destination 192.168.0.1:80
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

However, it is a bad way, because site is now also on wan:80 and this is not what I want. What is my mistake?

  • what happens if you add -m tcp? – JW0914 Feb 9 at 13:45
  • @JW0914 Is there any sense in adding -m tcp? I do use -p tcp and -m tcp is added automatically. – Pavel Feb 9 at 13:49
  • @Pavel Too bad you couldn't just forward port 777 from the WAN IP network to the port 80 private IP of that server and make the port forwarding transparent to the server system entirely where the port 777 iptables not even be needed. Some routers and/or firewalls support such features where you can say same if it comes inbound to the public IP address on port 777 to then forward that to the private IP address of the server on port 80. Simple as that and transparent to the server. The port 80 from the WAN would not be allowed to that server unless you allowed it to be, etc. with other rules. – Pimp Juice IT Feb 10 at 1:02
  • iptables does not seem like the best way to do that. Instead, configure the web server to Listen 192.168.0.1:80 and Listen wan:777. With Apache, that's done in /etc/apache2/ports.conf. – Curt Feb 13 at 3:53
  • Is it possible to have the web service bind to the WAN address and listen on port 777 as well, instead of trying to route traffic from WAN:777 to LAN:80? – Sam Forbis Feb 14 at 15:41
1

I got an answer on Russian Linux forum :

iptables -t mangle -A PREROUTING -i $WAN -p tcp --dport 777 -j MARK --set-mark 0x1234
iptables -t nat -A PREROUTING -p tcp -i $WAN --dport 777 -j DNAT --to-destination 192.168.0.1:80
iptables -A INPUT -m mark --mark 0x1234 -j ACCEPT
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.