Carlos,
Your port forwarding rule in the PREROUTING chain is correct.
Under the PREROUTING rules you have written, under the :OUTPUT ACCEPT[]
make sure you have added the following:
-A POSTROUTING -o <interface> -j MASQUERADE
Should fix your problems, if you do a save your iptables should look
something like this.... (You could load this with itptables-restore but
make sure you change <interface> to your requirement)
# Generated by iptables-save v1.3.3 on Mon Feb 27 16 10:38:46 2006
*raw
:PREROUTING ACCEPT [35476841:22352592026]
:OUTPUT ACCEPT [59531624:17069355061]
COMMIT
# Completed on Wed Nov 16 14:47:45 2005
# Generated by iptables-save v1.3.3 on Mon Feb 27 16 10:38:46 2006
*nat
:PREROUTING ACCEPT [274505:22189153]
:POSTROUTING ACCEPT [147918:9557802]
:OUTPUT ACCEPT [27739:1182815]
-A PREROUTING -i <interface> -p tcp -m tcp --dport 81 -j DNAT
--to-destination 192.168.0.1:139
-A POSTROUTING -o <interface> -j MASQUERADE
COMMIT
# Completed on Wed Nov 16 14:47:45 2005
# Generated by iptables-save v1.3.3 on Mon Feb 27 16 10:38:46 2006
*mangle
:PREROUTING ACCEPT [16298018:8703878298]
:INPUT ACCEPT [171692:14292343]
:FORWARD ACCEPT [16126260:8689578351]
:OUTPUT ACCEPT [21483782:5904513040]
:POSTROUTING ACCEPT [41477241:14671433871]
COMMIT
# Completed on Wed Nov 16 14:47:45 2005
# Generated by iptables-save v1.3.3 on Mon Feb 27 16 10:38:46 2006
*filter
:INPUT ACCEPT [171692:14292343]
:FORWARD ACCEPT [16126260:8689578351]
:OUTPUT ACCEPT [21483782:5904513040]
COMMIT
# Generated by iptables-save v1.3.3 on Mon Feb 27 16 10:38:46 2006
Tested should work np.
Dave Shaw
Network Security
C2 Communications
Carlos Costa wrote:
I'm trying to doing something simple with iptables: redirect one port
of my firewall machine to other port at other machine.
This is what I do:
iptables -t nat -A PREROUTING -p tcp --dport 81 -j DNAT --to 192.168.1.3:139
This is not a real example (I am really trying to do this with vnc
port), but here I don't have vnc, so I am testing with this.
In the FORWARD chain my policy is ACCEPT, so I assume that the packet
must go to 192.168.1.3:139 (I am logging the packets in FORWARD, and
there is no traffic).
I assume that 192.168.1.2:81 must be equivalent to 192.168.1.3:139, but:
merry:~# telnet 192.168.1.2 81
Trying 192.168.1.2...
telnet: Unable to connect to remote host: Connection refused
merry:~# telnet 192.168.1.3 139
Trying 192.168.1.3...
Connected to 192.168.1.3.
What I am doing wrong? Thank you very much,
Carlos.
