0

I'm working on Ubuntu 20.04. I set the following iptables rules:

sudo iptables -t nat -A POSTROUTING -d 192.168.10.162 -j MASQUERADE
sudo iptables -t nat -A PREROUTING -p tcp --dport 445 -j DNAT --to-destination 192.168.10.162:445

There 192.168.10.162 is another Ubuntu server of 18.04 running some smb server also.

When I run $sudo iptables -t nat -L -v, it shows the following:

Chain PREROUTING (policy ACCEPT 3 packets, 249 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  any    any     anywhere             anywhere             tcp dpt:microsoft-ds to:192.168.10.162:445

Chain INPUT (policy ACCEPT 1 packets, 149 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  any    any     anywhere             192.168.10.162

It means my nat commands has taken effects, right? And it means the packets to 445 (smb) port will be forwarded to 192.168.10.162:445, right?

I enabled ip forward by $sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward. I installed a smb server on the Ubuntu 20.04 machine and use another Win10 PC to access the shared directory of it. Then I found my visits, delete of files under the directory, or copy of files to the directory, shows no signs of records on the two nat rules I added.

And then after I mount the smb shared directory of 192.168.10.162 on the Ubuntu 20.04 machine, and visit its own smb shared directory as above, it still shows no sign of records in the PREROUTING rule but some in the POSTROUTING rule.

Chain PREROUTING (policy ACCEPT 176 packets, 16007 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  any    any     anywhere             anywhere             tcp dpt:microsoft-ds to:192.168.10.162:445

Chain INPUT (policy ACCEPT 74 packets, 10704 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 19 packets, 1620 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 18 packets, 1560 bytes)
 pkts bytes target     prot opt in     out     source               destination
    1    60 MASQUERADE  all  --  any    any     anywhere             192.168.10.162

It seems maybe the mount command triggered the record on my POSTROUTING rule. And I also tested that ping to 192.168.10.162 triggered records on this rule. But why there is no pkts or bytes captured on my PREROUTING rule? Even I copy a large file to the smb shared directory of the Ubuntu 20.04 machine.

[Update] I tried forwarding all packets with dport of 8080 to 192:168.10.162:80 running a web server. Then I use a Win10 PC to visit the machine (Ubuntu 20.04) via http://[ip address]:8080, it redirects to the web server. And iptables nat PREROUTING and POSTROUTING shows records.

Chain PREROUTING (policy ACCEPT 551 packets, 41812 bytes)
 pkts bytes target     prot opt in     out     source               destination
    5   260 DNAT       tcp  --  any    any     anywhere             anywhere             tcp dpt:http-alt to:192.168.10.162:80

Chain INPUT (policy ACCEPT 77 packets, 10563 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 12 packets, 922 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 12 packets, 922 bytes)
 pkts bytes target     prot opt in     out     source               destination
    5   260 MASQUERADE  tcp  --  any    any     anywhere             192.168.10.162       tcp dpt:http

[Update] I use $tcptrack to confirm that the packets did sent to the 445 port of Ubuntu 20.04. Again no packets were shown captured by nat PREROUTING.

Improve this question

2 Answers 2

Reset to default
1

You're trying SMB server, but you didn't DNAT all the SMB-replated ports. You also need these ports as well: 137,138,139

You can see a nice table on the ports and their corresponding TCP/UDP protocol here.

sudo iptables -t nat -A POSTROUTING -d 192.168.10.162 -j MASQUERADE
sudo iptables -t nat -A PREROUTING -m multiport --dports 137,138,139,445 -j DNAT --to-destination 192.168.10.162

Of course the second rule doesn't chek the correct TCP/UDP protocol for each port.

If you want your tables to work for this machine as well as the ones that this machine routes, then you have to do the same for the OUTPUT chain as well as the PREROUTING chain:

sudo iptables -t nat -A OUTPUT -m multiport --dports 137,138,139,445 -j DNAT --to-destination 192.168.10.162

This is because the packets that are generated from your own machine, don't go through the PREROUTING and go straight to the OUTPUT and then to the POSTROUTING.

Here's a diagram from nftables' hooks than can help you out in understanding this:

description

Improve this answer
18
  • Even so, why only one pkt of 60 bytes shown on the second rule?
    – li_jessen
    Dec 20, 2022 at 5:54
  • I tried, still the same. I found that smbd is listening on both 445 and 139 on the machine by $sudo netstat -tulpn | grep LISTEN.
    – li_jessen
    Dec 20, 2022 at 6:34
  • If you're trying smb from your the machine that you're setting these firewall rules, then your request won't go into PREROUTING. You'll have to do the same for the OUTPUT too if you want your system's request to be DNATed as well. The reason for the POSTROUTING working might be because you're testing SMB from this machine, or it could be because you're connection to that machine with unrelated-to-smb protocols (even pings to that machine will make POSTROUTING counts go up)
    – The Moisrex
    Dec 20, 2022 at 7:07
  • Now let's focus on PREROUTING. Why I can't find any hit in it after I visited the smb directory from a Win10 PC?
    – li_jessen
    Dec 20, 2022 at 7:21
  • It should get hit unless you have some other rules in other tables. Is this the scenario that you're testing right?: Win10 -----(smb to)-----> Ubuntu20 ------(but opens up smb from)-----> Ubuntu18(192.168.10.162)
    – The Moisrex
    Dec 20, 2022 at 8:07
0

I'm sorry to tell you all that I made a low-level mistake. I forgot to enable IPFORWARD in the Linux machine. After I run

sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"

It works.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .