Networking-Blog

My WordPress Blog

Categories

Linux Iptables Web-Redirect 8080

PREROUTING CHAIN :

sudo iptables -t nat -I PREROUTING 20 -s 85.234.70.18/32 -p tcp -m tcp –dport 80 -j
REDIRECT –to-ports 8080

IF DATA IS FOR FIREWALL : It will hit the INPUT chain.

INPUT CHAIN :

sudo iptables -I INPUT -p tcp -m tcp –dport 81 -j Content_Filter
sudo iptables -I INPUT -p tcp -m tcp –dport 8080 -j Content_Filter

CONTENT_FILTER CHAIN :

sudo iptables -I Content_Filter 3 -s 85.234.70.18/32 -j ACCEPT

FORWARD CHAIN :

sudo iptables -I FORWARD 17 -s 85.234.70.18/32 -j ACCEPT

Remote Site incoming traffic to be naTTed using  eth2 public ip address :

POSTROUTING CHAIN :

sudo iptables -t nat -I POSTROUTING 6 -o eth2 -s 85.234.70.18/32 -j SNAT –to 85.234.65.46

IpTables
No comments yet.

Tags:

by admin

Linux Transit VM Port Forward

Need forwarding to Telford Internal IP Address – 10.10.1.1
Fixed Internet IP Address – 1.1.1.1

Ports 40000, 41000, 42000, 43000, 44000, 45000, & 46000 need forwarding to 10.10.1.1

Configuration to be Done.

Need to create a Ethernet Subinterface on the VM :

# Advanced Micro Devices [AMD] 79c970 [PCnet32 LANCE]
DEVICE=eth1:3
BOOTPROTO=static
ONBOOT=yes
HWADDR=00:0c:29:fa:da:13
IPADDR=1.1.1.1
NETMASK=255.255.255.0
NETWORK=1.1.1.254
BROADCAST=1.1.1.253
Bring Interface UP :

sudo ifup eth1:3

To View a list of rules with the NAT table :

sudo iptables -vnL -t nat –line-numbers

Need to complete PREROUTING chain in order to DNAT these ports from WAN to destination LAN address :

sudo iptables -t nat -I PREROUTING 1 -d 1.1.1.1 -p tcp –dport 40000 -j DNAT –to 10.10.1.1
sudo iptables -t nat -I PREROUTING 2 -d 1.1.1.1 -p tcp –dport 41000 -j DNAT –to 10.10.1.1
sudo iptables -t nat -I PREROUTING 3 -d 1.1.1.1 -p tcp –dport 42000 -j DNAT –to 10.10.1.1
sudo iptables -t nat -I PREROUTING 4 -d 1.1.1.1 -p tcp –dport 43000 -j DNAT –to 10.10.1.1
sudo iptables -t nat -I PREROUTING 5 -d 1.1.1.1 -p tcp –dport 44000 -j DNAT –to 10.10.1.1
sudo iptables -t nat -I PREROUTING 6 -d 1.1.1.1 -p tcp –dport 45000 -j DNAT –to 10.10.1.1
sudo iptables -t nat -I PREROUTING 7 -d 1.1.1.1 -p tcp –dport 46000 -j DNAT –to 10.10.1.1

To summarize this as one rule :

sudo iptables -t nat -I PREROUTING 18 -d 85.234.86.115 -p tcp -m multiport –dport 40000,41000,42000,43000,44000,45000,46000 -j DNAT –to 10.10.1.1

Need to complete POSTROUTING chain in order to SNAT these ports from LAN address to destination Subinterface : :

sudo iptables -t nat -I POSTROUTING 20 -o eth1:3 -s 10.10.1.1 -p tcp -m multiport –dports 40000,41000,42000,43000,44000,45000,46000 -j SNAT –to 1.1.1.1

To Delete a Chain Rule

sudo iptables -t nat -D POSTROUTING 20
sudo iptables -t nat -D PREROUTING 20

Troubleshooting Diagnostics Testing :

From the Internet :

telnet 85.234.86.115 40000

B00m.

IpTables, Linux
No comments yet.

Tags: , , ,

by admin

Iptables Rules

less <filename> (reads a file)
vi <filename> (edits a file)

Local history file(s)

/.bash_history (records the last entries made, so less the file to read it)
/var/lib/iptables/rules-save (records the last entries saved in iptables)

Examples :

iptables -vnL  (lists the iptables ruleset)
iptables -vnL – t nat  (lists the iptables nat tables, i.e PREROUTING,POSTROUTING)

1. Inserts a rule in the INPUT chain at line 5 that allows 10.10.0.0/16 to 1.1.1.1

iptables -I INPUT 5 -s 10.10.0.0/16 -d 1.1.1.1 -j ACCEPT

2. Deletes the above rule :

iptables -D INPUT 5

-A will append the rule to the Chain, rather than insert it
-I will insert the rule to the Chain, rather than append it

3. REDIRECT port 80 traffic to port 8080

iptables -I PREROUTING 9 -t nat -s 1.1.1.1 -p tcp -m tcp –dport 80 -j REDIRECT –to-ports 8080

4. Source NAT everything from 1.1.1.1 to go out as 2.2.2.2
iptables -I POSTROUTING 20 -t nat -s 1.1.1.1 -o eth1 -j SNAT –to-source 2.2.2.2

5.  Allows 1.1.1.1  to talk to our ranges and vpn box

iptables -I POSTROUTING 8 -t nat -s 1.1.1.1 -d 83.44.16.6 -j ACCEPT
iptables -I POSTROUTING 12 -t nat -s 1.1.1.1 -d 83.44.16.8/29 -j ACCEPT

6. /etc/init.d/iptables save (saves the changes made to iptables)

7. DNATs, SNATs and ports

-i eth1 (for in port)
-o eth1 (for out port)

–dport <port number> (destination port) –to <ip address> (NAT to an IP)

Examples :

Adds a rule in to POSTROUTING chain, to SNAT everything out of eth0 with a source address of 172.16.26.1 to 83.44.16.6

iptables -I POSTROUTING 6 -t nat -o eth0 -s 172.16.26.1 -j SNAT –to 83.44.16.6

8. Adds a rule in PREROUTING to DNAT everything from 83.44.16.6 on tcp port 443 to 172.16.209.201

iptables -t nat -I PREROUTING -d 83.44.16.6 -p tcp –dport 443 -j DNAT –to 172.16.209.201

9. Adds a rule in the FORWARD chain allowing everything from 10.10.1.2 with a destination tcp port of 25

iptables -I FORWARD -s 10.10.1.2 -p tcp –dport 25 -j ACCEPT

IpTables
No comments yet.

Tags: , , ,

by admin

Iptables PreRouting Rule

sudo iptables -t nat -vnL
sudo iptables -t nat -vnL –line-numbers
!

Port Forward From A Static Public Ip. Port Translation from 4000 to 3389.
iptables -t nat -I PREROUTING -s public_ip -d internal_lan_int -p tcp -m tcp –dport 4000 -j DNAT –to-destination 10.11.254.4:3389

Port Forward From Any Public Ip.
iptables -t nat -I PREROUTING -d internal_lan_int -p tcp -m tcp –dport 25 -j DNAT –to-destination 10.11.254.250:25

Port Forward From A Static Public Ip to Internal Lan Webserver.
iptables -t nat -I PREROUTING -s public_ip -d internal_lan_ip -p tcp -m tcp –dport 80 -j ACCEPT

Port Forward From A Static Public Ip. Port Redirection from 80 to 8080.
iptables -t nat -I PREROUTING -s public_ip -d internal_lan_ip -p tcp -m tcp –dport 80 -j REDIRECT –to-ports 8080
Port Forward From Any Public Ip. Port Redirection from 80 to 8080.
iptables -t nat -I PREROUTING -s internal_lan_ip -p tcp -m tcp –dport 80 -j REDIRECT –to-ports 8080

Drop Port Forward Traffic from Public Ip.
iptables -t nat -I PREROUTING -s public_ip -j DROP

Adds a rule in PREROUTING to DNAT everything from 83.44.16.6 on tcp port 443 to 172.16.209.201
iptables -t nat -I PREROUTING -d 83.44.16.6 -p tcp –dport 443 -j DNAT –to 172.16.209.201

To Delete a rule :
sudo iptables -t nat -D PREROUTING 14

E.G :

Prerouting

If you have a server on your internal network that you want make available externally,
you can use the -j DNAT target of the PREROUTING chain in NAT to specify a
destination IP address and port where incoming packets requesting a connection to your
internal service can be forwarded.


use the following command:
This rule specifies that the nat table use the built-in PREROUTING chain to
forward incoming HTTP requests exclusively to the listed destination IP address of 172.31.0.23.

For example, if you want to forward incoming HTTP requests to your dedicated
Apache HTTP Server at 172.31.0.23,

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 172.31.0.23:80

If you have a default policy of DROP in your FORWARD chain, you must append a rule to
forward all incoming HTTP requests so that destination NAT routing is possible.

To do this, use the following command:
This rule forwards all incoming HTTP requests from the firewall to the intended destination;
the Apache HTTP Server behind the firewall.

iptables -A FORWARD -i eth0 -p tcp --dport 80 -d 172.31.0.23 -j ACCEPT
IpTables
No comments yet.

Tags: ,

by admin