Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: iptables conditional masquerade
Top Forums UNIX for Dummies Questions & Answers iptables conditional masquerade Post 302971440 by chebarbudo on Wednesday 20th of April 2016 07:50:04 AM
Old 04-20-2016
iptables conditional masquerade
Hi everyone,

I have a LAN with :
  • 1 internet box (192.168.1.1)
  • 1 Debian host (192.168.1.224)
  • 3 Windows hosts (192.168.1.32/33/34)
The internet box is set to route all incoming traffic to the Debian host (DMZ).

Then the Debian host is set to accept certain packets and forward others to the windows hosts. It's all based on the port number:
  • port 22 accepted
  • port 80 accepted
  • port 59032 forwarded to 192.168.1.32:5900
  • port 59033 forwarded to 192.168.1.33:5900
  • port 59034 forwarded to 192.168.1.34:5900
That allows me to ssh and web into my Debian host and to vnc into my Windows host from the outside world.

This is done by using iptables with the following rules:
Code:
iptables -t filter -A INPUT -i eth0 -p $tcp --dport 22 -j ACCEPT
iptables -t filter -A INPUT -i eth0 -p $tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 59032 -j DNAT --to 192.168.1.32:5900
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 59033 -j DNAT --to 192.168.1.33:5900
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 59034 -j DNAT --to 192.168.1.34:5900

The Debian host is happy receiving connections from the outside world.
But VNC on Windows would block packets if they are not from 192.168.1.0/24.
I could remove that restriction on the Windows host but NO, that's not what I want to do. So I'm using one more rule for iptables:
Code:
iptables -t nat -A POSTROUTING -j MASQUERADE

That way, the Windows host believe that the VNC connection is comming from the local server.

For future improvement reasons, I would rather masquerade only certain packets. So my idea is to do something in the nat.PREROUTING chain so that the nat.POSTROUTING chain will be able to tell whether a packet should be masqueraded or not.

Is there a way to achieve that or any workaround?

Thanks for your help.

Santiago
 

9 More Discussions You Might Find Interesting

1. IP Networking

Ftp'ing thru a Iptables NAT Masquerade

Greetings to all. My new firewall is giving me one hell of a problem. I'm running iptables and masquerading my intranet thru NAT. But here is the problem. Whenever I try to FTP to a server outside of my lan I get a 500 illegal port error. I've come to the conclusion that NAT is... (2 Replies)
Discussion started by: phrater
2 Replies

2. UNIX for Advanced & Expert Users

sendmail/mail masquerade problem

I have a SCO 5.06 box running sendmail 8.11. I have set up sendmail to masquerade the domainname as bar.com. ie in the sendmail.cf file the directive DMbar.com is set. When I send mail using mail/mailx, it appends the local hostname "foo" to the masquerade address and inserts this into... (1 Reply)
Discussion started by: m.szylkarski
1 Replies

3. OS X (Apple)

Ho do I masquerade the "user@user.local" address in mail/mailx?

Hi, I'm brand new here and looking for a solution: I'm using mail or mailx. The default reply address is «myshortusername@mylongusername.local» which makes absolutely no sense for anybody receiving my emails. But how do I change it? There seem to be many solutions but none for Mac OS X.... (0 Replies)
Discussion started by: gczychi
0 Replies

4. IP Networking

iptables: log connection after SNAT/MASQUERADE command

Hello! I have the following problem with iptables in Debian 6: My server works as a router and it needs to log server external IP+port for all outgoing connections. But after command SNAT or MASQUERADE traffic is "lost". I mean no following rules can catch those traffic. Everything looks... (0 Replies)
Discussion started by: unlimited
0 Replies

5. UNIX for Dummies Questions & Answers

Sendmail masquerade

Hi, Please tell me what is sendmail masquarade and what is the use of it? Its pretty confusing :eek:.. Is it all about like when mail is sent from sender to receiver, the receiver cannot see the hostname/internal username of sender.. And I found they constitute various classes like class... (0 Replies)
Discussion started by: Priya Amaresh
0 Replies

6. AIX

Sendmail masquerade

I'm trying to configure sendmail masquerading and it seems like I'm having a problem with m4. My main problem is that internally generated emails are showing up externally as originating from: internal_user@internal1.mydomain.com. internal1.mydomain.com doesn't resolve publicly, nor should it.... (1 Reply)
Discussion started by: aix_user1
1 Replies

7. IP Networking

iptables nat/masquerade - how to act as a basic firewall?

edit: SOLVED - see below for solution Hi there, I've inherited a gob of Linux hosts and so am learning linux from the bottom of the deep end of the pool (gotta say I'm warming up to Linux though - it's not half bad) Right now iptables is confusing me and I could use some pointers as to how... (0 Replies)
Discussion started by: Smiling Dragon
0 Replies

8. UNIX for Dummies Questions & Answers

Nullmailer masquerade domain

I am using nullmailer on Ubuntu Linux to relay mails however when I send email or through cron it appear as root@myhostname.domain.com instead of root@domain.com How do I configure nullmailer so the email send appear as from root@domain.com? (0 Replies)
Discussion started by: hassan1
0 Replies

9. UNIX for Beginners Questions & Answers

iptables : How to apply masquerade while pinging from DUT to outside network

My Device is connected to eth1 interface of the host and eth0 is connected to network. Now when I am pinging google.com from device after executing below commands on host sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE I am... (0 Replies)
Discussion started by: slathigara
0 Replies

LEARN ABOUT DEBIAN

findsmb

FINDSMB(1)							   User Commands							FINDSMB(1)

NAME

       findsmb - list info about machines that respond to SMB name queries on a subnet

SYNOPSIS

       findsmb [subnet broadcast address]

DESCRIPTION

       This perl script is part of the samba(7) suite.

       findsmb is a perl script that prints out several pieces of information about machines on a subnet that respond to SMB name query requests.
       It uses nmblookup(1) and smbclient(1) to obtain this information.

OPTIONS

       -r
	   Controls whether findsmb takes bugs in Windows95 into account when trying to find a Netbios name registered of the remote machine. This
	   option is disabled by default because it is specific to Windows 95 and Windows 95 machines only. If set, nmblookup(1) will be called
	   with -B option.

       subnet broadcast address
	   Without this option, findsmb will probe the subnet of the machine where findsmb(1) is run. This value is passed to nmblookup(1) as part
	   of the -B option.

EXAMPLES

       The output of findsmb lists the following information for all machines that respond to the initial nmblookup for any name: IP address,
       NetBIOS name, Workgroup name, operating system, and SMB server version.

       There will be a '+' in front of the workgroup name for machines that are local master browsers for that workgroup. There will be an '*' in
       front of the workgroup name for machines that are the domain master browser for that workgroup. Machines that are running Windows for
       Workgroups, Windows 95 or Windows 98 will not show any information about the operating system or server version.

       The command with -r option must be run on a system without nmbd(8) running. If nmbd is running on the system, you will only get the IP
       address and the DNS name of the machine. To get proper responses from Windows 95 and Windows 98 machines, the command must be run as root
       and with -r option on a machine without nmbd running.

       For example, running findsmb without -r option set would yield output similar to the following

	   IP ADDR	   NETBIOS NAME   WORKGROUP/OS/VERSION
	   ---------------------------------------------------------------------
	   192.168.35.10   MINESET-TEST1  [DMVENGR]
	   192.168.35.55   LINUXBOX	 *[MYGROUP] [Unix] [Samba 2.0.6]
	   192.168.35.56   HERBNT2	  [HERB-NT]
	   192.168.35.63   GANDALF	  [MVENGR] [Unix] [Samba 2.0.5a for IRIX]
	   192.168.35.65   SAUNA	  [WORKGROUP] [Unix] [Samba 1.9.18p10]
	   192.168.35.71   FROGSTAR	  [ENGR] [Unix] [Samba 2.0.0 for IRIX]
	   192.168.35.78   HERBDHCP1	 +[HERB]
	   192.168.35.88   SCNT2	 +[MVENGR] [Windows NT 4.0] [NT LAN Manager 4.0]
	   192.168.35.93   FROGSTAR-PC	  [MVENGR] [Windows 5.0] [Windows 2000 LAN Manager]
	   192.168.35.97   HERBNT1	 *[HERB-NT] [Windows NT 4.0] [NT LAN Manager 4.0]

VERSION

       This man page is correct for version 3 of the Samba suite.

SEE ALSO

       nmbd(8), smbclient(1), and nmblookup(1)

AUTHOR

       The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open
       Source project similar to the way the Linux kernel is developed.

       The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another excellent piece of Open
       Source software, available at ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to
       DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

Samba 3.5							    06/18/2010								FINDSMB(1)
All times are GMT -4. The time now is 05:14 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy