Iptables - forward email ports?
- by Emmet Brown
im trying to open some local ports (LAN) and then re-direct them to another server (WAN) using iptables.
Here is my config:
#WAN
allow-hotplug eth1
auto eth1
iface eth1 inet static
#Tarjeta red WAN
address 192.168.2.2
gateway 192.168.2.1
netmask 255.255.255.0
#LAN
allow-hotplug eth0
auto eth0
iface eth0 inet static
address 192.168.16.6
netmask 255.255.255.0
network 192.168.16.0
broadcast 192.168.16.255
I try this:
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 110 -j DNAT --to 200.40.30.218:110
iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 200.40.30.218 --dport 110 -j ACCEPT
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 25 -j DNAT --to 200.40.30.218:25
iptables -A FORWARD -p tcp -i eth0 -o ethq -d 200.40.30.218 --dport 25 -j ACCEPT
but, it did not work. i also try changeing eth0 to eth1 (and eth1 to eth0) but nothing happened.
Starting Nmap 5.00 ( http://nmap.org ) at 2011-10-03 14:44 UYST
Interesting ports on 192.168.16.6:
Not shown: 997 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
8080/tcp open http-proxy
Im running debian. Can u guys help me to check what is happening?
edit: IPTABLES-SAVE
# Generated by iptables-save v1.4.8 on Mon Oct 3 15:43:14 2011
*mangle
:PREROUTING ACCEPT [139993:77867651]
:INPUT ACCEPT [139385:77761761]
:FORWARD ACCEPT [186:12071]
:OUTPUT ACCEPT [173556:74341650]
:POSTROUTING ACCEPT [173734:74352988]
COMMIT
# Completed on Mon Oct 3 15:43:14 2011
# Generated by iptables-save v1.4.8 on Mon Oct 3 15:43:14 2011
*nat
:PREROUTING ACCEPT [1649:190626]
:POSTROUTING ACCEPT [6729:339646]
:OUTPUT ACCEPT [6697:337660]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 110 -j DNAT --to-destination 200.40.30.218:110
-A PREROUTING -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 200.40.30.218:25
COMMIT
# Completed on Mon Oct 3 15:43:14 2011
# Generated by iptables-save v1.4.8 on Mon Oct 3 15:43:14 2011
*filter
:INPUT ACCEPT [138307:77066136]
:FORWARD ACCEPT [168:11207]
:OUTPUT ACCEPT [172288:73655708]
-A FORWARD -d 200.40.30.218/32 -i eth0 -o eth1 -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -d 200.40.30.218/32 -i eth0 -o ethq -p tcp -m tcp --dport 25 -j ACCEPT
COMMIT
# Completed on Mon Oct 3 15:43:14 2011
Regards
