Ola I'm trying to setup port forwarding for ftp and scp (ssh) from internet to an internal host. For http it works fine, both http and https. I've added these rules to /etc/sysconfig/iptables on router (using FC2): #pluto port fwd *nat :PREROUTING ACCEPT [13:704] :POSTROUTING ACCEPT [17:1950] :OUTPUT ACCEPT [16:1890] #-A POSTROUTING -o eth0 -j MASQUERADE -A PREROUTING -d 81.196.83.211 -i eth0 -p tcp --dport 8080 -j DNAT --to- destination 192.168.0.11:80 -A PREROUTING -d 81.196.83.211 -i eth0 -p tcp --dport 8443 -j DNAT --to- destination 192.168.0.11:443 -A PREROUTING -d 81.196.83.211 -i eth0 -p tcp --dport 20 -j DNAT --to- destination 192.168.0.11:20 -A PREROUTING -d 81.196.83.211 -i eth0 -p tcp --dport 21 -j DNAT --to- destination 192.168.0.11:21 -A PREROUTING -d 81.196.83.211 -i eth0 -p tcp --dport 8022 -j DNAT --to- destination 192.168.0.11:22 -A PREROUTING -d 81.196.83.211 -i eth0 -p udp --dport 21 -j DNAT --to- destination 192.168.0.11:21 -A PREROUTING -d 81.196.83.211 -i eth0 -p udp --dport 8022 -j DNAT --to- destination 192.168.0.11:22 -A PREROUTING -j LOG #SNAT shouldn't be needed, connections are only from outside -A POSTROUTING -p tcp -d 81.196.83.211 --dport 21 -j SNAT --to-source 192.168.0.11 -A POSTROUTING -p tcp -d 81.196.83.211 --dport 20 -j SNAT --to-source 192.168.0.11 -A POSTROUTING -p udp -d 81.196.83.211 --dport 21 -j SNAT --to-source 192.168.0.11 -A POSTROUTING -p udp -d 81.196.83.211 --dport 20 -j SNAT --to-source 192.168.0.11 COMMIT *filter :INPUT ACCEPT [374:118200] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [385:44104] ... #pluto port fwd -A FORWARD -p tcp -d 192.168.0.11 -i eth0 --dport 80 -j ACCEPT -A FORWARD -p tcp -d 192.168.0.11 -i eth0 --dport 443 -j ACCEPT -A FORWARD -p tcp -d 192.168.0.11 -i eth0 --dport 21 -j ACCEPT -A FORWARD -p tcp -d 192.168.0.11 -i eth0 --dport 20 -j ACCEPT -A FORWARD -p udp -d 192.168.0.11 -i eth0 --dport 21 -j ACCEPT -A FORWARD -p udp -d 192.168.0.11 -i eth0 --dport 20 -j ACCEPT -A FORWARD -p tcp -d 192.168.0.11 -i eth0 --dport 22 -j ACCEPT -A FORWARD -j LOG Using ncftp client from outside, one can login but on ls it gives ncftp / > ls [delay] List failed. ncftp / > passive passive on ncftp / > ls connect failed: Network is unreachable. List failed. FTP from internal net works fine. Blocking is commented out temporarily. /proc/sys/net/ipv4/ip_forward is 1 Log gives Jun 29 09:32:16 marte kernel: IN=eth1 OUT=eth0 SRC=192.168.0.11 DST=207.197.204.138 LEN=123 TOS=0x00 PREC=0x00 TTL=63 ID=15667 DF PROTO=TCP SPT=21 DPT=33977 WINDOW=5792 RES=0x00 ACK PSH URGP=0 Jun 29 09:32:16 marte kernel: IN=eth1 OUT=eth0 SRC=192.168.0.11 DST=207.197.204.138 LEN=124 TOS=0x00 PREC=0x00 TTL=63 ID=15668 DF PROTO=TCP SPT=21 DPT=33977 WINDOW=5792 RES=0x00 ACK PSH URGP=0 Jun 29 09:32:17 marte kernel: IN=eth1 OUT=eth0 SRC=192.168.0.11 DST=207.197.204.138 LEN=150 TOS=0x00 PREC=0x00 TTL=63 ID=15669 DF PROTO=TCP SPT=21 DPT=33977 WINDOW=5792 RES=0x00 ACK PSH URGP=0 Jun 29 09:32:17 marte kernel: IN=eth1 OUT=eth0 SRC=192.168.0.11 DST=207.197.204.138 LEN=74 TOS=0x00 PREC=0x00 TTL=63 ID=15670 DF PROTO=TCP SPT=21 DPT=33977 WINDOW=5792 RES=0x00 ACK PSH URGP=0 Jun 29 09:32:18 marte kernel: IN=eth1 OUT=eth0 SRC=192.168.0.11 DST=207.197.204.138 LEN=103 TOS=0x00 PREC=0x00 TTL=63 ID=15671 DF PROTO=TCP SPT=21 DPT=33977 WINDOW=5792 RES=0x00 ACK PSH URGP=0 Jun 29 09:32:18 marte kernel: IN=eth1 OUT= MAC=00:20: ed:9f:3b:7f:00:48:54:1e:76:47:08:00 SRC=192.168.0.11 DST=207.197.204.138 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=59805 DF PROTO=TCP SPT=20 DPT=33978 WINDOW=5840 RES=0x00 SYN URGP=0 Jun 29 09:32:18 marte kernel: IN=eth1 OUT=eth0 SRC=192.168.0.11 DST=207.197.204.138 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=59805 DF PROTO=TCP SPT=20 DPT=33978 WINDOW=5840 RES=0x00 SYN URGP=0 Jun 29 09:32:18 marte kernel: IN=eth1 OUT=eth0 SRC=192.168.0.11 DST=207.197.204.138 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=15672 DF PROTO=TCP SPT=21 DPT=33977 WINDOW=5792 RES=0x00 ACK URGP=0 Jun 29 09:32:21 marte kernel: IN=eth1 OUT=eth0 SRC=192.168.0.11 DST=207.197.204.138 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=23271 DF PROTO=TCP SPT=21 DPT=33972 WINDOW=5792 RES=0x00 ACK PSH URGP=0 Jun 29 09:32:21 marte kernel: IN=eth1 OUT=eth0 SRC=192.168.0.11 DST=207.197.204.138 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=59806 DF PROTO=TCP SPT=20 DPT=33978 WINDOW=5840 RES=0x00 SYN URGP=0 Jun 29 09:32:27 marte kernel: IN=eth1 OUT=eth0 SRC=192.168.0.11 DST=207.197.204.138 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=59807 DF PROTO=TCP SPT=20 DPT=33978 WINDOW=5840 RES=0x00 SYN URGP=0 Jun 29 09:32:29 marte kernel: IN=eth0 OUT= MAC=00:c0:26:88: f7:85:00:04:76:9e:16:e0:08:00 SRC=208.245.212.67 DST=81.196.83.211 LEN=53 TOS=0x00 PREC=0x00 TTL=50 ID=22863 DF PROTO=TCP SPT=5222 DPT=32817 WINDOW=8940 RES=0x00 ACK PSH URGP=0 Jun 29 09:32:33 marte kernel: IN=eth1 OUT=eth0 SRC=192.168.0.11 DST=207.197.204.138 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=23272 DF PROTO=TCP SPT=21 DPT=33972 WINDOW=5792 RES=0x00 ACK PSH URGP=0 Jun 29 09:32:39 marte kernel: IN=eth1 OUT=eth0 SRC=192.168.0.11 DST=207.197.204.138 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=59808 DF PROTO=TCP SPT=20 DPT=33978 WINDOW=5840 RES=0x00 SYN URGP=0 Any suggestions appreciated, don't know what else to do. Thanks! -- Marius Andreiana Galuna - Solutii Linux in Romania http://www.galuna.ro
