Re: Port translation

stan skrev:

Uno Engborg wrote:

stan skrev:

Uno Engborg wrote:

Rüdiger Pretzlaff skrev:

Am 12.07.2008 um 12:21 schrieb Uno Engborg:

For various reasons I would like to forward trafic to port 390 to port 5432 on the same host. One would think this would be a simple task for iptables but I have now tinkered with this for two days, and I still fail to get it right.

I have also tried :

iptables -t nat -A PREROUTING -p tcp --dport 390 -j DNAT --to 192.168.0.5:5432

where 192.168.0.5 is the address of the host


Any ideas on how to do this?

From the man page it looks like you need a colon on the port for DNAT (and no IP

as it will stay the same if not specified, just what you want).

iptables -t nat -A PREROUTING -p tcp --dport 390 -j DNAT --to-destination :5432

I haven't tested, but it seems it should work.

Yes, removing the IP address was probably an improvemnet, but not enough to make it work.

Regards
Uno Engborg

You should add some LOG rules so you can see what is happening to the packet. They will show

you if the port is being altered.

If that doesn't work, could you post the output of iptables -n -L -v? That way everyone can see

exactly what iptables is programmed to do.

After applying:
iptables -t nat -A PREROUTING -p tcp --dport 390 -j REDIRECT --to-port 5432

iptables -t nat -L -v gives:

Chain PREROUTING (policy ACCEPT 207 packets, 17786 bytes)

Chain POSTROUTING (policy ACCEPT 321 packets, 20656 bytes)

Chain OUTPUT (policy ACCEPT 319 packets, 20536 bytes)

And iptables -n -L -v gives:
# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

Chain OUTPUT (policy ACCEPT 23922 packets, 37M bytes)

Chain RH-Firewall-1-INPUT (2 references)

Port redirection now works locally, but not on the eth0 interface.


Regards
Uno Engborg












--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list