iptables FORWARD rule

Question

I'm running 3 virtual machines with Fedora 19. The machine B is set up with two networks adapters and provides que channel between machine A and machine C.

The machine A IP is set to 192.168.1.1 and machine C IP is set to 172.16.1.1. On machine B I have one adapter with IP 192.168.1.254 and another adapter with IP 172.16.1.254.

I've created this rule in machine B (it's working as a router):

iptables -P INPUT DROP

iptables -A INPUT -p icmp -j ACCEPT

And so, no connections between the machines are made unless the PING that allows the communication between machine A and B.

Now I want to create a rule in the router that allows the communication of HTTPS between the external network (machine C) and the internal network (machine A)

I've added this rule in machine B:

iptables -A FORWARD -o p7p1 -p tcp --dport 443 -d 192.168.1.1 -j ACCEPT

Where p7p1 is the interface on machine B that connects to machine A. I've also tried:

iptables -A FORWARD -i p8p1 -o p7p1 -p tcp --dport 443 -d 192.168.1.1 -j ACCEPT

Where p8p1 is the interface on machine B that connects to machine C.

Now, on machine A I do nc -l 443 and on machine C nc 192.168.1.1 443 but I'm getting Ncat: Connection timed out

Whats wrong with my rule?

Answer 1

You are missing a rule that also allows the answers to go through your firewall.

I trust the code for netfilter and its powerful state module, so i'd use iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT so that also the packets in the other direction are allowed as well.

In your ruleset the answers from 192.168.1.1 to the other machine at 172.16.1.1 are blocked.

Also see documentation for iptables troubleshooting, for example this on linuxhomenetworking.com and add logging rules when things are not working.

iptables -A FORWARD -j LOG