Sponsored Content
Top Forums UNIX for Dummies Questions & Answers iptables conditional masquerade Post 302971440 by chebarbudo on Wednesday 20th of April 2016 07:50:04 AM
Old 04-20-2016
iptables conditional masquerade

Hi everyone,

I have a LAN with :
  • 1 internet box (192.168.1.1)
  • 1 Debian host (192.168.1.224)
  • 3 Windows hosts (192.168.1.32/33/34)
The internet box is set to route all incoming traffic to the Debian host (DMZ).

Then the Debian host is set to accept certain packets and forward others to the windows hosts. It's all based on the port number:
  • port 22 accepted
  • port 80 accepted
  • port 59032 forwarded to 192.168.1.32:5900
  • port 59033 forwarded to 192.168.1.33:5900
  • port 59034 forwarded to 192.168.1.34:5900
That allows me to ssh and web into my Debian host and to vnc into my Windows host from the outside world.

This is done by using iptables with the following rules:
Code:
iptables -t filter -A INPUT -i eth0 -p $tcp --dport 22 -j ACCEPT
iptables -t filter -A INPUT -i eth0 -p $tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 59032 -j DNAT --to 192.168.1.32:5900
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 59033 -j DNAT --to 192.168.1.33:5900
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 59034 -j DNAT --to 192.168.1.34:5900

The Debian host is happy receiving connections from the outside world.
But VNC on Windows would block packets if they are not from 192.168.1.0/24.
I could remove that restriction on the Windows host but NO, that's not what I want to do. So I'm using one more rule for iptables:
Code:
iptables -t nat -A POSTROUTING -j MASQUERADE

That way, the Windows host believe that the VNC connection is comming from the local server.

For future improvement reasons, I would rather masquerade only certain packets. So my idea is to do something in the nat.PREROUTING chain so that the nat.POSTROUTING chain will be able to tell whether a packet should be masqueraded or not.

Is there a way to achieve that or any workaround?

Thanks for your help.

Santiago
 

9 More Discussions You Might Find Interesting

1. IP Networking

Ftp'ing thru a Iptables NAT Masquerade

Greetings to all. My new firewall is giving me one hell of a problem. I'm running iptables and masquerading my intranet thru NAT. But here is the problem. Whenever I try to FTP to a server outside of my lan I get a 500 illegal port error. I've come to the conclusion that NAT is... (2 Replies)
Discussion started by: phrater
2 Replies

2. UNIX for Advanced & Expert Users

sendmail/mail masquerade problem

I have a SCO 5.06 box running sendmail 8.11. I have set up sendmail to masquerade the domainname as bar.com. ie in the sendmail.cf file the directive DMbar.com is set. When I send mail using mail/mailx, it appends the local hostname "foo" to the masquerade address and inserts this into... (1 Reply)
Discussion started by: m.szylkarski
1 Replies

3. OS X (Apple)

Ho do I masquerade the "user@user.local" address in mail/mailx?

Hi, I'm brand new here and looking for a solution: I'm using mail or mailx. The default reply address is «myshortusername@mylongusername.local» which makes absolutely no sense for anybody receiving my emails. But how do I change it? There seem to be many solutions but none for Mac OS X.... (0 Replies)
Discussion started by: gczychi
0 Replies

4. IP Networking

iptables: log connection after SNAT/MASQUERADE command

Hello! I have the following problem with iptables in Debian 6: My server works as a router and it needs to log server external IP+port for all outgoing connections. But after command SNAT or MASQUERADE traffic is "lost". I mean no following rules can catch those traffic. Everything looks... (0 Replies)
Discussion started by: unlimited
0 Replies

5. UNIX for Dummies Questions & Answers

Sendmail masquerade

Hi, Please tell me what is sendmail masquarade and what is the use of it? Its pretty confusing :eek:.. Is it all about like when mail is sent from sender to receiver, the receiver cannot see the hostname/internal username of sender.. And I found they constitute various classes like class... (0 Replies)
Discussion started by: Priya Amaresh
0 Replies

6. AIX

Sendmail masquerade

I'm trying to configure sendmail masquerading and it seems like I'm having a problem with m4. My main problem is that internally generated emails are showing up externally as originating from: internal_user@internal1.mydomain.com. internal1.mydomain.com doesn't resolve publicly, nor should it.... (1 Reply)
Discussion started by: aix_user1
1 Replies

7. IP Networking

iptables nat/masquerade - how to act as a basic firewall?

edit: SOLVED - see below for solution Hi there, I've inherited a gob of Linux hosts and so am learning linux from the bottom of the deep end of the pool (gotta say I'm warming up to Linux though - it's not half bad) Right now iptables is confusing me and I could use some pointers as to how... (0 Replies)
Discussion started by: Smiling Dragon
0 Replies

8. UNIX for Dummies Questions & Answers

Nullmailer masquerade domain

I am using nullmailer on Ubuntu Linux to relay mails however when I send email or through cron it appear as root@myhostname.domain.com instead of root@domain.com How do I configure nullmailer so the email send appear as from root@domain.com? (0 Replies)
Discussion started by: hassan1
0 Replies

9. UNIX for Beginners Questions & Answers

iptables : How to apply masquerade while pinging from DUT to outside network

My Device is connected to eth1 interface of the host and eth0 is connected to network. Now when I am pinging google.com from device after executing below commands on host sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE I am... (0 Replies)
Discussion started by: slathigara
0 Replies
SOCKET-CONTEXT-OPTIONS(3)						 1						 SOCKET-CONTEXT-OPTIONS(3)

Socket context options - Socket context option listing

	Socket context options are available for all wrappers that work over sockets, like tcp, http and ftp.

	      o $bindto
		-  Used to specify the IP address (either IPv4 or IPv6) and/or the port number that PHP will use to access the network. The syntax
		is ip:port for IPv4 addresses, and [ip]:port for IPv6 addresses. Setting the IP or the port to 0 will let the system choose the IP
		and/or port.

	      Note

		      As FTP creates two socket connections during normal operation, the port number cannot be specified using this option.

	      o $backlog
		- Used to limit the number of outstanding connections in the socket's listen queue.

	      Note

		      This is only applicable to stream_socket_server(3).

       +--------+-----------------+
       |Version |		  |
       |	|		  |
       |	|   Description   |
       |	|		  |
       +--------+-----------------+
       | 5.3.3	|		  |
       |	|		  |
       |	|  Added backlog. |
       |	|		  |
       | 5.1.0	|		  |
       |	|		  |
       |	|  Added bindto.  |
       |	|		  |
       +--------+-----------------+
       Example #1

	      Basic $bindto usage example

	      <?php
	      // connect to the internet using the '192.168.0.100' IP
	      $opts = array(
		  'socket' => array(
		      'bindto' => '192.168.0.100:0',
		  ),
	      );

	      // connect to the internet using the '192.168.0.100' IP and port '7000'
	      $opts = array(
		  'socket' => array(
		      'bindto' => '192.168.0.100:7000',
		  ),
	      );

	      // connect to the internet using the '2001:db8::1' IPv6 address
	      // and port '7000'
	      $opts = array(
		  'socket' => array(
		      'bindto' => '[2001:db8::1]:7000',
		  ),
	      );

	      // connect to the internet using port '7000'
	      $opts = array(
		  'socket' => array(
		      'bindto' => '0:7000',
		  ),
	      );

	      // create the context...
	      $context = stream_context_create($opts);

	      // ...and use it to fetch the data
	      echo file_get_contents('http://www.example.com', false, $context);

	      ?>

PHP Documentation Group 												 SOCKET-CONTEXT-OPTIONS(3)
All times are GMT -4. The time now is 02:51 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy