Iptables – Redirect traffic to different ip using iptables

firewalliptables

I have a debian linux firewall/gateway connecting my wan and lan working with iptables. I have eth1 as the wan with dynamic address 190.200.229.102 attached to somehost.com via DYNDNS and eht0 as the lan with address 192.168.128.2. Everything works as expected. Traffic coming in gets rejected for all ports except the ones specified with ACCEPT and the port forwarding works as expected redirecting traffic to the inside machines.

The problem is that when I try to connect to somehost.com from the inside network I don't get redirected to the internal machines as I expect. My firewall rules for port redirection are attached to the wan interface (eth1). I'm assuming that when I try to connect to somehost.com I'm coming from the lan connection and that is why the redirection does not work. I have experimented with REDIRECT, DNAT, INPUT and other tags without success. Any hints on how to achieve this?

Best Answer

I don't know the answer to your question. However as a work around why not had a fake DNS entry internally for somehost.com pointed at the LAN IP instead?

Related Solutions

Iptables – redirect outbound traffic to internal IP using iptables

I'm guessing that you're doing NAT for traffic from NET A to NET B, in which case you'll need to add a rule to exclude traffic from NET A destined for the NET B address of the DD-WRT - something like:

iptables -t nat -I POSTROUTING -s <net.a.ip.block/mask> -d <dd-wrt.net.b.address> -j ACCEPT

or you could do a rewrite of the address like so:

iptables -t nat -I PREROUTING -s <net.a.ip.block/mask> -d <dd-wrt.net.b.address> -j DNAT --to <SERVER.net.a.address>

EDIT: Rereading the question properly you'll need a variant of the second method:

iptables -t nat -I PREROUTING -s <net.a.ip.block/mask> -d <fw.wan.add.ress> -j DNAT --to <server.net.a.address>

Iptables – Difference beetween DNAT and REDIRECT in IPTABLES

REDIRECT alters the destination IP address to send to the machine itself. In other words, locally generated packets are mapped to the 127.0.0.1 address. It's for redirecting local packets. If you only want to redirect the traffic between services on the local machine, it will be a good choice.

DNAT is actual Network Address Translation. If you want packets destinated outside of the local system to have the destination altered, it's the better choice of the two, as REDIRECT will not work.

Best Answer

Related Solutions

Iptables – redirect outbound traffic to internal IP using iptables

Iptables – Difference beetween DNAT and REDIRECT in IPTABLES

Related Topic