Iptables not forward traffic
Clash Royale CLAN TAG#URR8PPP
I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic.
iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport 9750 -j DNAT --to-destination x.x.x.b:9750
iptables -t nat -A POSTROUTING -p tcp --dport 9750 -j MASQUERADE
However, the host x.x.x.a does not open port 9750. Clients do not connect to the server.
cat /etc/sysctl.conf |grep forward
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1
# Uncomment the next line to enable packet forwarding for IPv6
#net.ipv6.conf.all.forwarding=1
iptables
asked Jul 14 '14 at 10:12
vinegretvinegret
357
add a comment |
I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic.
iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport 9750 -j DNAT --to-destination x.x.x.b:9750
iptables -t nat -A POSTROUTING -p tcp --dport 9750 -j MASQUERADE
However, the host x.x.x.a does not open port 9750. Clients do not connect to the server.
cat /etc/sysctl.conf |grep forward
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1
# Uncomment the next line to enable packet forwarding for IPv6
#net.ipv6.conf.all.forwarding=1
iptables
asked Jul 14 '14 at 10:12
vinegretvinegret
357
1
Problem was solved. Helped the following commands: iptables -A FORWARD -d x.x.x.b -i eth1 -p tcp -m tcp --dport 9750 -j ACCEPT && iptables -t nat -A PREROUTING -d x.x.x.a -p tcp -m tcp --dport 9750 -j DNAT --to-destination x.x.x.b && iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
– vinegret
Jul 14 '14 at 13:32
add a comment |
I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic.
iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport 9750 -j DNAT --to-destination x.x.x.b:9750
iptables -t nat -A POSTROUTING -p tcp --dport 9750 -j MASQUERADE
However, the host x.x.x.a does not open port 9750. Clients do not connect to the server.
cat /etc/sysctl.conf |grep forward
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1
# Uncomment the next line to enable packet forwarding for IPv6
#net.ipv6.conf.all.forwarding=1
iptables
asked Jul 14 '14 at 10:12
vinegretvinegret
357
I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic.
iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport 9750 -j DNAT --to-destination x.x.x.b:9750
iptables -t nat -A POSTROUTING -p tcp --dport 9750 -j MASQUERADE
However, the host x.x.x.a does not open port 9750. Clients do not connect to the server.
cat /etc/sysctl.conf |grep forward
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1
# Uncomment the next line to enable packet forwarding for IPv6
#net.ipv6.conf.all.forwarding=1
iptables
iptables
asked Jul 14 '14 at 10:12
vinegretvinegret
357
asked Jul 14 '14 at 10:12
vinegretvinegret
357
edited Jul 14 '14 at 10:56
vinegret
asked Jul 14 '14 at 10:12
vinegretvinegret
357
asked Jul 14 '14 at 10:12
vinegretvinegret
357
asked Jul 14 '14 at 10:12
vinegretvinegret
357
357
1
Problem was solved. Helped the following commands: iptables -A FORWARD -d x.x.x.b -i eth1 -p tcp -m tcp --dport 9750 -j ACCEPT && iptables -t nat -A PREROUTING -d x.x.x.a -p tcp -m tcp --dport 9750 -j DNAT --to-destination x.x.x.b && iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
– vinegret
Jul 14 '14 at 13:32
add a comment |
1
Problem was solved. Helped the following commands: iptables -A FORWARD -d x.x.x.b -i eth1 -p tcp -m tcp --dport 9750 -j ACCEPT && iptables -t nat -A PREROUTING -d x.x.x.a -p tcp -m tcp --dport 9750 -j DNAT --to-destination x.x.x.b && iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
– vinegret
Jul 14 '14 at 13:32
1
1
Problem was solved. Helped the following commands: iptables -A FORWARD -d x.x.x.b -i eth1 -p tcp -m tcp --dport 9750 -j ACCEPT && iptables -t nat -A PREROUTING -d x.x.x.a -p tcp -m tcp --dport 9750 -j DNAT --to-destination x.x.x.b && iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
– vinegret
Jul 14 '14 at 13:32
Problem was solved. Helped the following commands: iptables -A FORWARD -d x.x.x.b -i eth1 -p tcp -m tcp --dport 9750 -j ACCEPT && iptables -t nat -A PREROUTING -d x.x.x.a -p tcp -m tcp --dport 9750 -j DNAT --to-destination x.x.x.b && iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
– vinegret
Jul 14 '14 at 13:32
add a comment |
2 Answers
2
active
oldest
votes
You did not provide packet forwarding configuration, so I hope you missed it. Temporarily you can enable it by:-
echo 1 >/proc/sys/net/ipv4/ip_forward
To make it permanent open /etc/sysctl.conf and provide this parameter:-
net.ipv4.ip_forward=1
answered Jul 14 '14 at 10:33
beginerbeginer
2,0681117
cat /proc/sys/net/ipv4/ip_forward 1
– vinegret
Jul 14 '14 at 10:38
ok then the chat server, is it tcp itself? I think now its time to do some debugging.
– beginer
Jul 14 '14 at 10:43
add a comment |
I'm not sure what your intentions were with x.x.x.a and x.x.x.b. For the PREROUTING rule you need to specify the external interface and the internal machine's IP:Port.
For port forwarding you don't need a MASQUERADE rule. However, you do need a rule to allow the traffic on the FORWARD chain.
iptables -A PREROUTING -t nat -i [external_iface] -p [proto] --dport [external_port] -j DNAT --to [internal_ip]:[internal_port]
iptables -A FORWARD -p [proto] -d [internal_ip] --dport [internal_port] -j ACCEPT
answered Jul 14 '14 at 12:12
CreekCreek
3,75611229
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 9750 -j DNAT --to x.x.x.b iptables -A FORWARD -p tcp -d x.x.x.b --dport 9750 -j ACCEPT does not work
– vinegret
Jul 14 '14 at 12:49
you're missing the port for the PREROUTING rule, it should bex.x.x.b:port
– Creek
Jul 14 '14 at 13:27
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f144443%2fiptables-not-forward-traffic%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
You did not provide packet forwarding configuration, so I hope you missed it. Temporarily you can enable it by:-
echo 1 >/proc/sys/net/ipv4/ip_forward
To make it permanent open /etc/sysctl.conf and provide this parameter:-
net.ipv4.ip_forward=1
answered Jul 14 '14 at 10:33
beginerbeginer
2,0681117
cat /proc/sys/net/ipv4/ip_forward 1
– vinegret
Jul 14 '14 at 10:38
ok then the chat server, is it tcp itself? I think now its time to do some debugging.
– beginer
Jul 14 '14 at 10:43
add a comment |
You did not provide packet forwarding configuration, so I hope you missed it. Temporarily you can enable it by:-
echo 1 >/proc/sys/net/ipv4/ip_forward
To make it permanent open /etc/sysctl.conf and provide this parameter:-
net.ipv4.ip_forward=1
answered Jul 14 '14 at 10:33
beginerbeginer
2,0681117
cat /proc/sys/net/ipv4/ip_forward 1
– vinegret
Jul 14 '14 at 10:38
ok then the chat server, is it tcp itself? I think now its time to do some debugging.
– beginer
Jul 14 '14 at 10:43
add a comment |
You did not provide packet forwarding configuration, so I hope you missed it. Temporarily you can enable it by:-
echo 1 >/proc/sys/net/ipv4/ip_forward
To make it permanent open /etc/sysctl.conf and provide this parameter:-
net.ipv4.ip_forward=1
answered Jul 14 '14 at 10:33
beginerbeginer
2,0681117
You did not provide packet forwarding configuration, so I hope you missed it. Temporarily you can enable it by:-
echo 1 >/proc/sys/net/ipv4/ip_forward
To make it permanent open /etc/sysctl.conf and provide this parameter:-
net.ipv4.ip_forward=1
answered Jul 14 '14 at 10:33
beginerbeginer
2,0681117
answered Jul 14 '14 at 10:33
beginerbeginer
2,0681117
answered Jul 14 '14 at 10:33
beginerbeginer
2,0681117
answered Jul 14 '14 at 10:33
beginerbeginer
2,0681117
2,0681117
cat /proc/sys/net/ipv4/ip_forward 1
– vinegret
Jul 14 '14 at 10:38
ok then the chat server, is it tcp itself? I think now its time to do some debugging.
– beginer
Jul 14 '14 at 10:43
add a comment |
cat /proc/sys/net/ipv4/ip_forward 1
– vinegret
Jul 14 '14 at 10:38
ok then the chat server, is it tcp itself? I think now its time to do some debugging.
– beginer
Jul 14 '14 at 10:43
cat /proc/sys/net/ipv4/ip_forward 1
– vinegret
Jul 14 '14 at 10:38
cat /proc/sys/net/ipv4/ip_forward 1
– vinegret
Jul 14 '14 at 10:38
ok then the chat server, is it tcp itself? I think now its time to do some debugging.
– beginer
Jul 14 '14 at 10:43
ok then the chat server, is it tcp itself? I think now its time to do some debugging.
– beginer
Jul 14 '14 at 10:43
add a comment |
I'm not sure what your intentions were with x.x.x.a and x.x.x.b. For the PREROUTING rule you need to specify the external interface and the internal machine's IP:Port.
For port forwarding you don't need a MASQUERADE rule. However, you do need a rule to allow the traffic on the FORWARD chain.
iptables -A PREROUTING -t nat -i [external_iface] -p [proto] --dport [external_port] -j DNAT --to [internal_ip]:[internal_port]
iptables -A FORWARD -p [proto] -d [internal_ip] --dport [internal_port] -j ACCEPT
answered Jul 14 '14 at 12:12
CreekCreek
3,75611229
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 9750 -j DNAT --to x.x.x.b iptables -A FORWARD -p tcp -d x.x.x.b --dport 9750 -j ACCEPT does not work
– vinegret
Jul 14 '14 at 12:49
you're missing the port for the PREROUTING rule, it should bex.x.x.b:port
– Creek
Jul 14 '14 at 13:27
add a comment |
I'm not sure what your intentions were with x.x.x.a and x.x.x.b. For the PREROUTING rule you need to specify the external interface and the internal machine's IP:Port.
For port forwarding you don't need a MASQUERADE rule. However, you do need a rule to allow the traffic on the FORWARD chain.
iptables -A PREROUTING -t nat -i [external_iface] -p [proto] --dport [external_port] -j DNAT --to [internal_ip]:[internal_port]
iptables -A FORWARD -p [proto] -d [internal_ip] --dport [internal_port] -j ACCEPT
answered Jul 14 '14 at 12:12
CreekCreek
3,75611229
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 9750 -j DNAT --to x.x.x.b iptables -A FORWARD -p tcp -d x.x.x.b --dport 9750 -j ACCEPT does not work
– vinegret
Jul 14 '14 at 12:49
you're missing the port for the PREROUTING rule, it should bex.x.x.b:port
– Creek
Jul 14 '14 at 13:27
add a comment |
I'm not sure what your intentions were with x.x.x.a and x.x.x.b. For the PREROUTING rule you need to specify the external interface and the internal machine's IP:Port.
For port forwarding you don't need a MASQUERADE rule. However, you do need a rule to allow the traffic on the FORWARD chain.
iptables -A PREROUTING -t nat -i [external_iface] -p [proto] --dport [external_port] -j DNAT --to [internal_ip]:[internal_port]
iptables -A FORWARD -p [proto] -d [internal_ip] --dport [internal_port] -j ACCEPT
answered Jul 14 '14 at 12:12
CreekCreek
3,75611229
I'm not sure what your intentions were with x.x.x.a and x.x.x.b. For the PREROUTING rule you need to specify the external interface and the internal machine's IP:Port.
For port forwarding you don't need a MASQUERADE rule. However, you do need a rule to allow the traffic on the FORWARD chain.
iptables -A PREROUTING -t nat -i [external_iface] -p [proto] --dport [external_port] -j DNAT --to [internal_ip]:[internal_port]
iptables -A FORWARD -p [proto] -d [internal_ip] --dport [internal_port] -j ACCEPT
answered Jul 14 '14 at 12:12
CreekCreek
3,75611229
answered Jul 14 '14 at 12:12
CreekCreek
3,75611229
answered Jul 14 '14 at 12:12
CreekCreek
3,75611229
answered Jul 14 '14 at 12:12
CreekCreek
3,75611229
3,75611229
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 9750 -j DNAT --to x.x.x.b iptables -A FORWARD -p tcp -d x.x.x.b --dport 9750 -j ACCEPT does not work
– vinegret
Jul 14 '14 at 12:49
you're missing the port for the PREROUTING rule, it should bex.x.x.b:port
– Creek
Jul 14 '14 at 13:27
add a comment |
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 9750 -j DNAT --to x.x.x.b iptables -A FORWARD -p tcp -d x.x.x.b --dport 9750 -j ACCEPT does not work
– vinegret
Jul 14 '14 at 12:49
you're missing the port for the PREROUTING rule, it should bex.x.x.b:port
– Creek
Jul 14 '14 at 13:27
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 9750 -j DNAT --to x.x.x.b iptables -A FORWARD -p tcp -d x.x.x.b --dport 9750 -j ACCEPT does not work
– vinegret
Jul 14 '14 at 12:49
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 9750 -j DNAT --to x.x.x.b iptables -A FORWARD -p tcp -d x.x.x.b --dport 9750 -j ACCEPT does not work
– vinegret
Jul 14 '14 at 12:49
you're missing the port for the PREROUTING rule, it should be
x.x.x.b:port– Creek
Jul 14 '14 at 13:27
you're missing the port for the PREROUTING rule, it should be
x.x.x.b:port– Creek
Jul 14 '14 at 13:27
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f144443%2fiptables-not-forward-traffic%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Problem was solved. Helped the following commands: iptables -A FORWARD -d x.x.x.b -i eth1 -p tcp -m tcp --dport 9750 -j ACCEPT && iptables -t nat -A PREROUTING -d x.x.x.a -p tcp -m tcp --dport 9750 -j DNAT --to-destination x.x.x.b && iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
– vinegret
Jul 14 '14 at 13:32