IPtables: DNAT not working
- by GetFree
In a CentOS server I have, I want to forward port 8080 to a third-party webserver.
So I added this rule:
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination thirdparty_server_ip:80
But it doesn't seem to work.
In an effort to debug the process, I added these two LOG rules:
iptables -t mangle -A PREROUTING -p tcp --src my_laptop_ip --dport ! 22 -j LOG --log-level warning --log-prefix "[_REQUEST_COMING_FROM_CLIENT_] "
iptables -t nat -A POSTROUTING -p tcp --dst thirdparty_server_ip -j LOG --log-level warning --log-prefix "[_REQUEST_BEING_FORWARDED_] "
(the --dport ! 22 part is there just to filter out the SSH traffic so that my log file doesn't get flooded)
According to this page the mangle/PREROUTING chain is the first one to process incomming packets and the nat/POSTROUTING chain is the last one to process outgoing packets.
And since the nat/PREROUTING chain comes in the middle of the other two, the three rules should do this:
the rule in mangle/PREROUTING logs the incomming packets
the rule in nat/PREROUTING modifies the packets (it changes the dest IP and port)
the rule in nat/POSTROUTING logs the modified packets about to be forwarded
Although the first rule does log incomming packets comming from my laptop, the third rule doesn't log the packets which are supposed to be modified by the second rule. It does log, however, packets that are produced in the server, hence I know the two LOG rules are working properly.
Why are the packets not being forwarded, or at least why are they not being logged by the third rule?
PS: there are no more rules than those three. All other chains in all tables are empty and with policy ACCEPT.
