1

I have 2 PC be created by VMWARE

1. PC1 (make iptables router):

ens33 's IP:  192.168.1.5/24  (network connection is bridged)
ens37 's IP:  192.168.2.2/24. (network connection is wmnet9)

2. PC2 (web server):

ens33 's IP:  192.168.2.1/24. (network connection is wmnet9)

3. My IP real PC:

192.168.1.16/24

How to word my real PC can connect to the webserver via iptables?

I tried to worked:

echo 1 />proc/sys/net/ipv4/ip_forward

iptables -t nat -A PREROUTING -p tcp 192.168.1.5 --dport 80 -j DNAT --to-destination 192.168.2.2:80
iptables -A FORWARD -p tcp -d 192.168.2.2 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -S 192.168.2.2 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -d 192.168.2.2 --dport 80 -j ACCEPT

But I get connection by google chrome is alert This site can’t be reached

My iptables rules:

   iptables -v -x -n -L  


    Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

     pkts   bytes target  prot opt in   out  source        destination

     9      456 ACCEPT     tcp  --  *    *   0.0.0.0/0      192.168.2.2 tcp dpt:80

    Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

    pkts    bytes target  prot opt in   out  source        destination

      0      0  ACCEPT     tcp  --  *    *   0.0.0.0/0      192.168.2.2 tcp dpt:80

      0      0 ACCEPT     tcp  --  *     *   192.168.2.2    0.0.0.0/0 tcp spt:80

    Chain OUTPUT (policy ACCEPT 9 packets, 360 bytes)

    pkts    bytes target  prot opt in   out  source        destination

--

    iptables -t nat -v -x -n -L

    Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)

    pkts bytes target  prot opt in    out   source        destination

     9   456   DNAT   tcp  --  *      *   0.0.0.0/0    192.168.168.1.5 tcp dpt:80 to:192.168.2.2:80

    Chain INPUT (policy ACCEPT 9 packets, 456 bytes) 

     pkts bytes target  prot opt in  out  source   destination

    Chain OUTPUT (policy ACCEPT 594 packets, 38555 bytes)

     pkts bytes target  prot opt in  out  source   destination

    Chain POSTROUTING (policy ACCEPT 181 packets, 11845 bytes)

     pkts bytes target  prot opt in  out  source   destination

     413  26710  SNAT   all  --  *  ens33 0.0.0.0/0  0.0.0.0/0 to:192.168.1.5
4
  • I gave an answer based on default policies of ACCEPT. If your default policies are DROP, then please post your entire iptables rules set. Post the outputs for sudo iptables -v -x -n -L and sudo iptables -t nat -v -x -n -L. Apr 30, 2016 at 0:49
  • Can you not post the actual output, and all of it? What is going on with 192.168.1.74? You seem to have a chain called "fw-chain", what it that about? We can not help you with incomplete information. Apr 30, 2016 at 14:38
  • Please post text files and program output listings as text, not as images (see How do I save terminal output to a file?). Apr 30, 2016 at 20:35
  • all of your packet counters are zero. It would be better to get outputs after you try to connect, so that we can observe the packet counters as to where packets are going. Does 192.168.2.2 know to route packets back via 192.168.1.5? May 1, 2016 at 14:30

2 Answers 2

2

You have not provided a return path. You need:

iptables -t nat -A POSTROUTING -o ens33 -j SNAT --to 192.168.1.5

I assume it is just a typo in your PREROUTING line, but regardless I would do it this way anyhow:

iptables -t nat -A PREROUTING -p tcp -i ens33 --dport 80 -j DNAT --to-destination 192.168.2.2:80

If your default policy for the FORWARD chain is ACCEPT, then you do not need those rules. You do not need the INPUT chain rule.

1
  • I tried to added iptables -t nat -A POSTROUTING -o ens33 -j SNAT --to 192.168.1.5. When connecting web 192.168.1.5, it don't connect with webserver 192.168.2.2. I have install different apache in iptables pc and it return web 192.168.1.5 Apr 30, 2016 at 13:04
0

I suscess to try with commands:

iptables -A PREROUTING -t nat -p tcp -d 192.168.1.5 --dport 80 -j DNAT --to-destination 192.168.2.1

iptables -A POSTROUTING -t nat -o ens37 -j MASQUERADE

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .