-1

I need help with iptables to allow all requests come from one single IP.

Server1 IP : 1.1.1.1 [Dedicated Server]

Server2 IP : 2.2.2.2. [VPS Server]

Both Servers are running Ubuntu, and are NOT on the same network.

I have service running on Server1 on port 1234. I want all traffic to come to server1 only from server2. And, if a request is received by Server1 directly, instead of killing/dropping the request, is it possible for server1 to forward the request to Server2, and have server2 send it to server1.

On Server2 I have:

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward 
iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination 1.1.1.1:1234
iptables -t nat -A POSTROUTING -j MASQUERADE

On Server1 where the service is running, I have:

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward 
iptables -I INPUT -p tcp -s 2.2.2.2 --dport 1234 -j ACCEPT

The Server2 is redirecting requests fine to Server1. Can you help me with iptables command for Server1, to route all other incoming IP requests through server2?

Thank you.

0
0

your question is not clear?

I can't understand what you want exactly

but what I got it that you have two server, and you have a running service on server1

you need to access this service only from server2 and not directly to server1 like the following:

request --> 1.1.1.1:1234 (drop)
request --> 2.2.2.2:1234 --> 1.1.1.1:1234 (accept)

for that you need to do the following rules:

server1:

accept incoming traffic to port 1234 from 2.2.2.2

drop other incoming traffic to port 1234

iptables -I INPUT -p tcp -s 2.2.2.2 --dport 1234 -j ACCEPT
iptables -I INPUT -p udp -s 2.2.2.2 --dport 1234 -j ACCEPT

iptables -I INPUT -p tcp -s 0.0.0.0/0 --dport 1234 -j DROP
iptables -I INPUT -p udp -s 0.0.0.0/0 --dport 1234 -j DROP

server2:

redirection rules:

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward 
iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination 1.1.1.1:1234
iptables -t nat -A POSTROUTING -j MASQUERADE
1
  • Thank you. The only additional rule needed here is instead of dropping the connection, , is it possible to route it to 2.2.2.2 so that the connection originates from there. request --> 1.1.1.1:1234 (dont drop, but redirect) --> 2.2.2.2 Oct 2 '20 at 6:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.