NetFilter
[Top] [All Lists]

Re: iptables: hide the real web server from users

To: Mail List - Netfilter <netfilter@lists.netfilter.org>
Subject: Re: iptables: hide the real web server from users
From: Pascal Hambourg <pascal.mail@plouf.fr.eu.org>
Date: Thu, 15 Feb 2007 16:08:56 +0100
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
In-reply-to: <869165.54710.qm@web33305.mail.mud.yahoo.com>
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
Organization: Plouf !
References: <869165.54710.qm@web33305.mail.mud.yahoo.com>
Sender: netfilter-bounces@lists.netfilter.org
User-agent: Mozilla Thunderbird 1.0.6 (Windows/20050716)
Tim Perton a écrit :
I tried the forward rules too but nothing.
Still telnet a.b.c.d 1099 does not work after issuing
the following commands(no other firewalling made to
prohibit packets):

iptables -A INPUT -p tcp -m tcp --dport 1099 -j ACCEPT

This rule is useless because connections to port 1099 are forwarded to another host. INPUT chains see only traffic for the local host.

iptables -A FORWARD -i eth0 -o eth0 -d 216.239.59.103
-p tcp --dport 80 -j ACCEPT

Ok.

iptables -A FORWARD -i eth0 -o eth0 -s 216.239.59.103
-p tcp --sport 80 -j ACCEPT

Use the connection tracking (-m state --state ESTABLISHED) to deal with return traffic.

iptables -t nat -A PREROUTING -i eth0 -d a.b.c.d -p
tcp --dport 1099 -j DNAT --to-destination
216.239.59.103:80

Ok.

iptables -t nat -A POSTROUTING -o eth0 -d
216.239.59.103 -p tcp --dport 1099 -j SNAT --to-source
a.b.c.d

The rule must match on destination port 80 instead of 1099, because it occurs after the destination port has been translated. Remember the path is :
PREROUTING (DNAT) -> FORWARD -> POSTROUTING (SNAT)


<Prev in Thread] Current Thread [Next in Thread>