0

I use a CentOS 7 as a gateway server. It has two network interfaces, ens28 and ens29.

The ens28 uses a private 192.168.x.x network, it is considered as the WAN. Ens29 is the LAN area with a 172.16.0.0 subnet.

I configured a NAT configuration via iptables, so the hosts on the 172... subnet can reach the internet.

Now I want a host on the subnet 172 to broadcast its webserver on port 443.

My basic configuration before the port forwarding:

# Generated by iptables-save v1.4.21 on Mon Nov 30 21:45:11 2020
*nat
:PREROUTING ACCEPT [65:4705]
:INPUT ACCEPT [1:60]
:OUTPUT ACCEPT [1:72]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o ens28 -j MASQUERADE
COMMIT
# Completed on Mon Nov 30 21:45:11 2020
# Generated by iptables-save v1.4.21 on Mon Nov 30 21:45:11 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [24:4585]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i ens28 -o ens29 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ens29 -o ens28 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

As for the forwarding, I tried with these rules:

iptables -A PREROUTING -t nat -i ens28 -p tcp --dport 443 -j DNAT --to 172.16.0.202:443
iptables -A FORWARD -p tcp -d 172.16.0.202 --dport 443 -j ACCEPT

My iptables configuration after adding the new rules:

# Generated by iptables-save v1.4.21 on Tue Dec  1 15:39:36 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [434:52068]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i ens28 -o ens29 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ens29 -o ens28 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -d 172.16.0.202/32 -p tcp -m tcp --dport 443 -j ACCEPT
COMMIT
# Completed on Tue Dec  1 15:39:36 2020
# Generated by iptables-save v1.4.21 on Tue Dec  1 15:39:36 2020
*nat
:PREROUTING ACCEPT [297:55943]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [7:532]
:POSTROUTING ACCEPT [7:532]
-A PREROUTING -i ens28 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.16.0.202:443
-A POSTROUTING -o ens28 -j MASQUERADE
COMMIT
# Completed on Tue Dec  1 15:39:36 2020
  1. The webserver host's IP address is the 172.16.0.202
  2. The ens28 card's address is 192.168.1.254
  3. The ens29 card's address is 172.16.0.253

Port 443 is forwarded on the external router (192.168.1.0 > public IP) and is visible from the internet.

Forwarding is enabled in sysctl:

net.ipv4.ip_forward = 1

So, what I'm missing? Why is the forwarding from the 172...'s not working?

Thanks in advance.

1 Answer 1

0

Rules are checked one by one.
Each rule after the reject will be ignored.

You should invert

-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -d 172.16.0.202/32 -p tcp -m tcp --dport 443 -j ACCEPT

to

-A FORWARD -d 172.16.0.202/32 -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
4
  • I've removed that REJECT rule (not even needed, it was auto. generated by iptables), but still not working.
    – Peet
    Dec 2, 2020 at 21:02
  • Did you check if the connection gets to your gateway server with a tool lie tcpdump or wireshark? Dec 3, 2020 at 16:42
  • And just to check, does the reject command show up with iptables -L? Dec 3, 2020 at 16:44
  • I think, it was the open port check tool fooled me...it doesn't see the port open, still the service works from over the WAN. I think, this case is solved now.
    – Peet
    Dec 5, 2020 at 18:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .