I have a ubuntu 17.04, and I configured DNS, DHCP and iptables, everything was working as expected. Now just port forwards do not work. DNS and DHCP and internet is all available to computers in the private subnet.
Here is my setup:
eno1 is the exterior/public NIC
enp2s0f1 is the private subnet NIT
myubuntu enp2s0f1 ip: 192.168.0.1
ubuntu@myubuntu:~$ sudo iptables -L --line-numbers
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
ubuntu@myubuntu:~$ sudo iptables -t nat --line-numbers -L
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 DNAT tcp -- anywhere anywhere tcp dpt:http to:192.168.0.51:8080
Chain INPUT (policy ACCEPT)
num target prot opt source destination
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 MASQUERADE all -- anywhere anywhere
ubuntu@myubuntu:~$ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.10.6.1 0.0.0.0 UG 0 0 0 eno1
10.10.6.0 0.0.0.0 255.255.255.0 U 0 0 0 eno1
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 eno1
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 enp2s0f1
I' m thinking it has to be something silly... But I can not find it. Any help will be appreciated.
I flipped the POSTROUTE MASQUERADE to the WAN nic and I have the NAT forwards working for my RDP (3389). However another NAT going to a different server does not work???? This NAT is mapped from port 80 on the router to port 8080 on another cpu, and it does not work.
ubuntu@myubuntu:/$ sudo iptables -t nat -v -x -n -L --line-numbers
Chain PREROUTING (policy ACCEPT 340 packets, 29199 bytes)
num pkts bytes target prot opt in out source destination
1 1 52 DNAT tcp -- eno1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9997 to:192.168.0.4:3389
2 0 0 DNAT tcp -- eno1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:192.168.0.51:8080
3 0 0 DNAT tcp -- eno1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:81 to:192.168.0.51:8080
For NAT #1 I can see packets flowing into it, but for NATs 2 & 3 I do not? Nothing is blocking these ports locally.
Any suggestions?