0

I have 2 PC be created by VMWARE

1. PC1 (make iptables router):

ens33 's IP:  192.168.1.5/24  (network connection is bridged)
ens37 's IP:  192.168.2.2/24. (network connection is wmnet9)

2. PC2 (web server):

ens33 's IP:  192.168.2.1/24. (network connection is wmnet9)

3. My IP real PC:

192.168.1.16/24

How to word my real PC can connect to the webserver via iptables?

I tried to worked:

echo 1 />proc/sys/net/ipv4/ip_forward

iptables -t nat -A PREROUTING -p tcp 192.168.1.5 --dport 80 -j DNAT --to-destination 192.168.2.2:80
iptables -A FORWARD -p tcp -d 192.168.2.2 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -S 192.168.2.2 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -d 192.168.2.2 --dport 80 -j ACCEPT

But I get connection by google chrome is alert This site can’t be reached

My iptables rules:

   iptables -v -x -n -L  


    Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

     pkts   bytes target  prot opt in   out  source        destination

     9      456 ACCEPT     tcp  --  *    *   0.0.0.0/0      192.168.2.2 tcp dpt:80

    Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

    pkts    bytes target  prot opt in   out  source        destination

      0      0  ACCEPT     tcp  --  *    *   0.0.0.0/0      192.168.2.2 tcp dpt:80

      0      0 ACCEPT     tcp  --  *     *   192.168.2.2    0.0.0.0/0 tcp spt:80

    Chain OUTPUT (policy ACCEPT 9 packets, 360 bytes)

    pkts    bytes target  prot opt in   out  source        destination

--

    iptables -t nat -v -x -n -L

    Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)

    pkts bytes target  prot opt in    out   source        destination

     9   456   DNAT   tcp  --  *      *   0.0.0.0/0    192.168.168.1.5 tcp dpt:80 to:192.168.2.2:80

    Chain INPUT (policy ACCEPT 9 packets, 456 bytes) 

     pkts bytes target  prot opt in  out  source   destination

    Chain OUTPUT (policy ACCEPT 594 packets, 38555 bytes)

     pkts bytes target  prot opt in  out  source   destination

    Chain POSTROUTING (policy ACCEPT 181 packets, 11845 bytes)

     pkts bytes target  prot opt in  out  source   destination

     413  26710  SNAT   all  --  *  ens33 0.0.0.0/0  0.0.0.0/0 to:192.168.1.5
  • I gave an answer based on default policies of ACCEPT. If your default policies are DROP, then please post your entire iptables rules set. Post the outputs for sudo iptables -v -x -n -L and sudo iptables -t nat -v -x -n -L. – Doug Smythies Apr 30 '16 at 0:49
  • Can you not post the actual output, and all of it? What is going on with 192.168.1.74? You seem to have a chain called "fw-chain", what it that about? We can not help you with incomplete information. – Doug Smythies Apr 30 '16 at 14:38
  • Please post text files and program output listings as text, not as images (see How do I save terminal output to a file?). – David Foerster Apr 30 '16 at 20:35
  • all of your packet counters are zero. It would be better to get outputs after you try to connect, so that we can observe the packet counters as to where packets are going. Does 192.168.2.2 know to route packets back via 192.168.1.5? – Doug Smythies May 1 '16 at 14:30
2

You have not provided a return path. You need:

iptables -t nat -A POSTROUTING -o ens33 -j SNAT --to 192.168.1.5

I assume it is just a typo in your PREROUTING line, but regardless I would do it this way anyhow:

iptables -t nat -A PREROUTING -p tcp -i ens33 --dport 80 -j DNAT --to-destination 192.168.2.2:80

If your default policy for the FORWARD chain is ACCEPT, then you do not need those rules. You do not need the INPUT chain rule.

  • I tried to added iptables -t nat -A POSTROUTING -o ens33 -j SNAT --to 192.168.1.5. When connecting web 192.168.1.5, it don't connect with webserver 192.168.2.2. I have install different apache in iptables pc and it return web 192.168.1.5 – QChí Nguyễn Apr 30 '16 at 13:04
0

I suscess to try with commands:

iptables -A PREROUTING -t nat -p tcp -d 192.168.1.5 --dport 80 -j DNAT --to-destination 192.168.2.1

iptables -A POSTROUTING -t nat -o ens37 -j MASQUERADE

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.