2

I'm running Ubuntu Server (natty) in as a gateway/firewall in front of a private network. I have successfully enabled IP forwarding and NAT so the machines behind the firewall can connect to Internet (followed the instructions from https://help.ubuntu.com/11.04/serverguide/C/firewall.html).

What I want now, is that a specific IP behind this firewall, whenever wants to connect to an external service to enforced to use only a specific port:

192.168.0.2 (application) -> 184.72.64.256 (gateway, fictive ip) -> 51.72.64.256 (service, fictive ip)

So whenever 192.168.0.2 wants to connect to 51.72.64.256 I want it t be enforced by router to use port 10002 (from port range 10002-12000). 51.72.64.256 allows connections from gateway to ports 10002-12000.

Is there a way to create a custom chain and plug it into ufw, so that I will still be able to use ufw in the intended way and be able to dynamically update this chain whenever I add machines behind this firewall.

Improve this question

1 Answer 1

Reset to default
3

You can do that by adding a iptables rule using REDIRECT to redirect all requests done by a --src on a specific --dport to be redirected to another specific --to-ports

I would look something like this:

iptables -t nat -I OUTPUT --src 192.168.0.2 --dst 51.72.64.256 -p tcp --dport 80 -j REDIRECT --to-ports 10002

Edit:

Correct answer was supplied by Calin Don after testing:

iptables -t nat -I PREROUTING --src 192.168.0.2 --dst 51.72.64.256 -p tcp --dport 11000:12000 -j DNAT --to-destination 51.72.64.256:11002

Improve this answer
2
  • I have tried it, but it doesn't work. What works instead is: iptables -t nat -I PREROUTING --src 192.168.0.2 --dst 51.72.64.256 -p tcp --dport 11000:12000 -j DNAT --to-destination 51.72.64.256:11002
    – Calin Don
    Oct 4, 2011 at 13:07
  • Well, gj then! ;)
    – Bruno Pereira
    Oct 4, 2011 at 13:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .