1
I'm setting up an Ubuntu 11.10 server to act as firewall for a network running several different SSL websites. The idea is fairly common: have all public IP's for each site aliased to the public interface on the firewall and use iptables/NAT to forward connections in to the web servers. I'm having a devil of a time getting this fairly simple thing to work though.
Say I have a public-facing interface on the firewall:
eth0 25.25.25.25
And I want to alias a new IP to that public interface:
ifconfig eth0:0 25.25.25.26
I then see the interface is created and I can ping it from other hosts. So far so good. Now I have my web server sitting on the DMZ side of the network, accessible by the firewall but not the public. Let's say the internal web server is 172.16.2.1. So I create a NAT rule as follows:
iptables -t nat -A PREROUTING -i eth0 -d 25.25.25.26 -j DNAT --to-destination 172.16.2.1
It just doesn't want to work. If I run tcpdump on the public interface, it will see the incoming traffic, but iptables just won't NAT it to the destination.
It will work fine if I use a non-aliased IP, such as 25.25.25.25. I've read that iptables doesn't like working with virtual interfaces and ignores them. That's fine, but it should still be working with "eth0" instead of "eth0:0". In my case, iptables does not complain if I try to use "eth0:0" but it doesn't make any difference.
I've been using OpenBSD for a long time now, so I'm comfortable setting this same thing up with pf. But years ago I used to do this with a RedHat box and it worked just fine. Has something changed? There has to be a way to do this. I've seen several examples from other folks saying that you just need to make sure you specify the main device (eth0) instead of using eth0:0. But I've got nothing.
Oh, and to rule out that this is just a filtering problem, I've completely disabled all filter rules:
iptables -F
iptables -X
iptables -P FORWARD ACCEPT
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
Any ideas? I'm certainly no newbie when it comes to iptables, but this problem is starting to make me feel like one.
The
FORWARD
chain is not part of thenat
table. Your proposed 'correction' will not be accepted byiptables
-- it will give you an error message instead. – Larssend – 2017-02-15T07:19:57.197Also, DNAT is only valid for
PREROUTING
andOUTPUT
chains. Please avoid recommending anything that you don't really know. – Larssend – 2017-02-15T07:35:39.577