IPTABLES - Problemas com Roteamento de Pacotes
Não consigo rotear nada que venha da internet para acesso ao meu servidor http que está em minha rede interna.
Só pra orientar melhor:
eth0 - 200.xxx.xxx.107
eth0:1 200.xxx.xxx.106
eth1: 192.168.0.1
Servidor http: 192.168.0.200
Tentei incluir o comando:
iptables -t nat -A PREROUTING -S 200.xxx.xxx.106 -p tcp --dport 80 -j DNAT --to 192.168.0.200
Mas nada aconteceu...
Este é o meu iptables:
# Generated by iptables-save v1.2.6a on Thu Dec 12 08:36:07 2002
*nat
REROUTING ACCEPT [562:66976]
OSTROUTING ACCEPT [20:1462]
UTPUT ACCEPT [45:3116]
-A POSTROUTING -o eth0 -j SNAT --to-source 200.xxx.xxx.107
#-A POSTROUTING -o eth0:1 -j SNAT --to-source 200.xxx.xxx.106
COMMIT
# Completed on Thu Dec 12 08:36:07 2002
# Generated by iptables-save v1.2.6a on Thu Dec 12 08:36:07 2002
*filter
:INPUT DROP [178:30711]
:FORWARD DROP [28:1750]
UTPUT DROP [0:0]
:allowed - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_packets - [0:0]
:udpincoming_packets - [0:0]
-A INPUT -p tcp -j bad_tcp_packets
-A INPUT -i eth0 -p icmp -j icmp_packets
-A INPUT -i eth0 -p tcp -j tcp_packets
-A INPUT -i eth0 -p udp -j udpincoming_packets
-A INPUT -d 192.168.255.255 -i eth1 -j ACCEPT
-A INPUT -s 127.0.0.1 -i lo -j ACCEPT
-A INPUT -s 192.168.0.1 -i lo -j ACCEPT
-A INPUT -s 200.xxx.xxx.107 -i lo -j ACCEPT
-A INPUT -s 200.xxx.xxx.106 -i lo -j ACCEPT
-A INPUT -s 192.168.0.0/255.255.255.0 -i eth1 -j ACCEPT
-A INPUT -d 200.xxx.xxx.107 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -d 200.xxx.xxx.106 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m limit --limit 3/min --limit-burst 3 -j DROP
-A FORWARD -p tcp -j bad_tcp_packets
-A FORWARD -i eth1 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m limit --limit 3/min --limit-burst 3 -j DROP
-A OUTPUT -p tcp -j bad_tcp_packets
-A OUTPUT -s 127.0.0.1 -j ACCEPT
-A OUTPUT -s 192.168.0.1 -j ACCEPT
-A OUTPUT -s 200.xxx.xxx.107 -j ACCEPT
-A OUTPUT -s 200.xxx.xxx.106 -j ACCEPT
-A OUTPUT -m limit --limit 3/min --limit-burst 3 -j DROP
-A allowed -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A allowed -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A allowed -p tcp -j DROP
-A bad_tcp_packets -p tcp -m state --state NEW -m tcp ! --tcp-flags SYN,RST,ACK SYN -j DROP
-A bad_tcp_packets -p tcp -m state --state NEW -m tcp ! --tcp-flags SYN,RST,ACK SYN -j DROP
-A bad_tcp_packets -s 192.168.0.0/255.255.0.0 -i eth0 -j DROP
-A bad_tcp_packets -s 10.0.0.0/255.0.0.0 -i eth0 -j DROP
-A bad_tcp_packets -s 172.16.0.0/255.240.0.0 -i eth0 -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A tcp_packets -p tcp -m tcp --dport 21 -j allowed
-A tcp_packets -p tcp -m tcp --dport 22 -j allowed
-A tcp_packets -p tcp -m tcp --dport 25 -j allowed
-A tcp_packets -p tcp -m tcp --dport 80 -j allowed
-A tcp_packets -p tcp -m tcp --dport 113 -j allowed
-A tcp_packets -p tcp -m tcp --dport 110 -j allowed
-A tcp_packets -p tcp -m tcp --dport 3128 -j allowed
-A tcp_packets -p tcp -m tcp --dport 2593 -j allowed
-A tcp_packets -p tcp -m tcp --dport 8888 -j allowed
-A udpincoming_packets -p udp -m udp --sport 2074 -j ACCEPT
-A udpincoming_packets -p udp -m udp --sport 4000 -j ACCEPT
COMMIT
# Completed on Thu Dec 12 08:36:07 2002
