I'm working on Ubuntu 20.04. I set the following iptables rules:
sudo iptables -t nat -A POSTROUTING -d 192.168.10.162 -j MASQUERADE
sudo iptables -t nat -A PREROUTING -p tcp --dport 445 -j DNAT --to-destination 192.168.10.162:445
There 192.168.10.162 is another Ubuntu server of 18.04 running some smb server also.
When I run $sudo iptables -t nat -L -v, it shows the following:
Chain PREROUTING (policy ACCEPT 3 packets, 249 bytes)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- any any anywhere anywhere tcp dpt:microsoft-ds to:192.168.10.162:445
Chain INPUT (policy ACCEPT 1 packets, 149 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- any any anywhere 192.168.10.162
It means my nat commands has taken effects, right? And it means the packets to 445 (smb) port will be forwarded to 192.168.10.162:445, right?
I enabled ip forward by $sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward. I installed a smb server on the Ubuntu 20.04 machine and use another Win10 PC to access the shared directory of it. Then I found my visits, delete of files under the directory, or copy of files to the directory, shows no signs of records on the two nat rules I added.
And then after I mount the smb shared directory of 192.168.10.162 on the Ubuntu 20.04 machine, and visit its own smb shared directory as above, it still shows no sign of records in the PREROUTING rule but some in the POSTROUTING rule.
Chain PREROUTING (policy ACCEPT 176 packets, 16007 bytes)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- any any anywhere anywhere tcp dpt:microsoft-ds to:192.168.10.162:445
Chain INPUT (policy ACCEPT 74 packets, 10704 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 19 packets, 1620 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 18 packets, 1560 bytes)
pkts bytes target prot opt in out source destination
1 60 MASQUERADE all -- any any anywhere 192.168.10.162
It seems maybe the mount command triggered the record on my POSTROUTING rule. And I also tested that ping to 192.168.10.162 triggered records on this rule. But why there is no pkts or bytes captured on my PREROUTING rule? Even I copy a large file to the smb shared directory of the Ubuntu 20.04 machine.
[Update] I tried forwarding all packets with dport of 8080 to 192:168.10.162:80 running a web server. Then I use a Win10 PC to visit the machine (Ubuntu 20.04) via http://[ip address]:8080, it redirects to the web server. And iptables nat PREROUTING and POSTROUTING shows records.
Chain PREROUTING (policy ACCEPT 551 packets, 41812 bytes)
pkts bytes target prot opt in out source destination
5 260 DNAT tcp -- any any anywhere anywhere tcp dpt:http-alt to:192.168.10.162:80
Chain INPUT (policy ACCEPT 77 packets, 10563 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 12 packets, 922 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 12 packets, 922 bytes)
pkts bytes target prot opt in out source destination
5 260 MASQUERADE tcp -- any any anywhere 192.168.10.162 tcp dpt:http
[Update] I use $tcptrack to confirm that the packets did sent to the 445 port of Ubuntu 20.04. Again no packets were shown captured by nat PREROUTING.