Forwarding an incoming port to an external service not working

Question

I am trying to forward traffic incoming on a certain port to another server, for example: myserver.com:8081 -> externalserver.com:15081.

My specific use case is for SSH, however I set up http://port81.helpfulseb.com:81 (no SSL) to test with the solution in this question. But it didn't work.

Here's exactly the commands I ran:

iptables -t nat -A PREROUTING -p tcp --dport 81 -j DNAT --to-destination 158.69.48.226:81
iptables -t nat -A POSTROUTING -p tcp -d 158.69.48.226 --dport 81 -j SNAT --to-source <my external IP address, i.e. 51.68...>

158.69.48.226 is the address of port81.helpfulseb.com

When I attempt to connect to myserver.com:81 the request times out. The output of iptables -t nat -v -L shows a handful of incoming packets, but nothing outgoing. I'm assuming that these are control packets that are received but for some reason the response is not being properly routed.

$ iptables -t nat -v -L -n --line-number

Chain PREROUTING (policy ACCEPT 16632 packets, 665K bytes)
num   pkts bytes target     prot opt in     out     source               destination
1       27  1276 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:81 to:158.69.48.226:81

Chain INPUT (policy ACCEPT 16632 packets, 665K bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 492 packets, 33023 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 492 packets, 33023 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 SNAT       tcp  --  *      *       0.0.0.0/0            158.69.48.226        tcp dpt:81 to:<my external IP>

I'm using Ubuntu 18.04 LTS, if that helps.

is forwarding enabled ``cat /proc/sys/net/ipv4/ip_forward`` should be 1 — Soulimane Mammar, Mar 05 '19 at 19:22
@SoulimaneMammar IP Forwarding was indeed disabled, I have enabled it now and my HTTP test works! I will post another update once I have tested it with SSH. — Sebastian King, Mar 05 '19 at 20:13
@SoulimaneMammar I managed to get it work using SSH. I needed to enable forwarding and then I had to specify the postrouting `--dport` as the same port as the external server, not the open port on my server. — Sebastian King, Mar 05 '19 at 23:19

score 0 · Answer 1 · answered Mar 06 '19 at 11:53

0

If you are not tied to iptables, there is the socat solution :

root@myserver.com# /usr/bin/socat TCP-LISTEN:8081,fork,reuseaddr TCP:externalserver.com:15081

answered Mar 06 '19 at 11:53

Chaoxiang N

1,218
4
10

Forwarding an incoming port to an external service not working

1 Answers1