iptables simple forwarding setup woes

Question

I have iptables running on a host (acting as a firewall) in a Linux namespace with only one network interface: h2-eth1 (has an IP and MAC address)

I have set up my switch to forward all packets to the firewall, and the packets returned from the firewall to the internal network. Now, I proceed to do a simple sanity check to see if everything is working. I run these commands on the firewall:

$sudo bash -c 'echo 1 > /proc/sys/net/ipv4/ip_forward'
$iptables -P INPUT ACCEPT
$iptables -P FORWARD DROP
$iptables -P OUTPUT ACCEPT

$iptables -F INPUT 
$iptables -F FORWARD 
$iptables -F OUTPUT 
$iptables -F -t nat

$iptables -A FORWARD -i h2-eth1 -o h2-eth1 -j ACCEPT

Now, I ping an internal host from outside. I see ICMP packets going to the firewall but none coming back from it. So, I ran iptables -nvL on the firewall and I see all tables (INPUT, OUTPUT, and FORWARD) have packet count 0. So, the packets are not reaching iptables because they don't match the IP address of the NIC? How do I correct this?

Answer 1

By setting up a DNAT. All you are doing at the moment is passing everything to the INPUT chain on your firewall. You can't just "ping an internal host from outside" because outside knows nothing about the inner network because the internal addresses aren't public.

Example: Hosting a webserver in the LAN you want visible to WAN (Internet)

iptables -t nat -A PREROUTING -p tcp -d <FIREWALL EXTERNAL IP> --dport 80 -j DNAT --to-destination <INTERNAL HOST IP>:80

This will make it appear that the firewall is hosting a webserver but it's actually forwarding everything to an internel server. You have to do this for each service and protocol you want to forward to the internal network.