Very Computer

I want to forward an outside port to a port on my LAN.
I've got a webserver running on the server that connects to the internet.

I want incoming connections on port 5678 to go to 192.168.0.95
And I want incoming connection on port 80 to keep connecting to my server
(192.168.0.1)

When I do the following:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 5678 -j DNAT --to-dest
192.168.0.95
iptables -A FORWARD -p tcp -i eth0 --dport 5678 -d 192.168.0.95 -j ACCEPT

Outside servers can no longer connect to my webserver!!

Why is this? I would really appreciate any comments that could shed some
light on this!!

I've since discovered that if I omit the second command, everything works.
Port gets forwarded. Whoopdee doo. So what's the point of the FORWARD table
then?

Thanks!

Coenraad

The rules you have written are correct and they should not affect your
webserver, so it's a mistery for me why this doesn't work.

Anyway I would use Ethereal to see what happens to the traffic and
how the webserver acts with the FORWARD rule and without it. Maybe
that way you can see what's happening.

Quote:> Thanks!

> Coenraad

--

Jose Maria Lopez Hernandez
Director Tecnico de bgSEC

bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPA?A

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                 -- Jack Kerouac, "On the Road"

# SET UP YOUR DESTINATIONS AND SOURCES (ASSUMING eth0 IS THE EXTERNAL
INTERFACE.)
iptables -t nat -A PREROUTING -d <ext.addr.> -i <interface(eth0)> -j
DNAT --to <int.addr.>
iptables -t nat -A POSTROUTING -s <int.addr.> -o <interface(eth0)> -j
SNAT --to <ext.addr.>
# I WOULD CHANGE MY DEFAULT POLICIES BUT THIS IS OPTIONAL
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
# NOW SET YOUR FORWARD TABLE FOR CONNECTIONS STARTING FROM THE OUTSIDE
iptables -A FORWARD -p <protocol(tcp)> -i <ext.interface> -o
<int.interface> -d <int.addr.> [-m multiport --dport 80,443] [-m state
--state NEW] -j ACCEPT
# NOW YOU NEED TO GET THE CONNECTIONS BACK
iptables -A FORWARD -p <protocol(tcp)> -i <int.interface> -o
<ext.interface>-s <int.addr.> [-m multiport --sport 80,443] [-m state
--state ESTABLISHED,RELATED] -j ACCEPT

I HOPE THIS HELPS