Политика по умолчанию - ACCEPT во всех цепочках.
Включаю sysctl net.ipv4.ip_forward=1 и добавляю одно-единственное правило:
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 1234 -j DNAT --to-destination 127.0.0.1:22Локально соединяюсь с портом 22 - открыт. С другой машины соединяюсь с портом 1234 - ответ не приходит.
Вывод iptables-save:
# Generated by iptables-save v1.4.8 on Mon Aug 23 22:22:27 2010
*filter
:INPUT ACCEPT [4582:8743735]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1694:17100939]
COMMIT
# Completed on Mon Aug 23 22:22:27 2010
# Generated by iptables-save v1.4.8 on Mon Aug 23 22:22:27 2010
*nat
:PREROUTING ACCEPT [17:1851]
:POSTROUTING ACCEPT [12:1005]
:OUTPUT ACCEPT [12:1005]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1234 -j DNAT --to-destination 127.0.0.1:22
COMMIT
# Completed on Mon Aug 23 22:22:27 2010Вывод /proc/sys/net/ipv4/ip_forward :
1Трафик с машины, на которой NAT:
$ sudo tcpdump -i eth0 tcp and port 1234 -vvn
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
22:25:24.118464 IP (tos 0x10, ttl 64, id 29200, offset 0, flags [DF], proto TCP (6), length 60)
10.2.9.65.54322 > 10.2.9.5.1234: Flags [S], cksum 0x7f36 (correct), seq 638609563, win 5840, options [mss 1460,sackOK,TS val 158734987 ecr 0,nop,wscale 6], length 0
22:25:27.119549 IP (tos 0x10, ttl 64, id 29201, offset 0, flags [DF], proto TCP (6), length 60)
10.2.9.65.54322 > 10.2.9.5.1234: Flags [S], cksum 0x7c48 (correct), seq 638609563, win 5840, options [mss 1460,sackOK,TS val 158735737 ecr 0,nop,wscale 6], length 0
22:25:33.114375 IP (tos 0x10, ttl 64, id 29202, offset 0, flags [DF], proto TCP (6), length 60)
10.2.9.65.54322 > 10.2.9.5.1234: Flags [S], cksum 0x766c (correct), seq 638609563, win 5840, options [mss 1460,sackOK,TS val 158737237 ecr 0,nop,wscale 6], length 0
22:25:45.116010 IP (tos 0x10, ttl 64, id 29203, offset 0, flags [DF], proto TCP (6), length 60)
10.2.9.65.54322 > 10.2.9.5.1234: Flags [S], cksum 0x6ab4 (correct), seq 638609563, win 5840, options [mss 1460,sackOK,TS val 158740237 ecr 0,nop,wscale 6], length 0Трафик с машины, на которой telnet:
$ sudo tcpdump -i eth2 tcp and port 1234 -vvn
tcpdump: listening on eth2, link-type EN10MB (Ethernet), capture size 96 bytes
22:13:52.061540 IP (tos 0x10, ttl 64, id 29200, offset 0, flags [DF], proto TCP (6), length 60) 10.2.9.65.54322 > 10.2.9.5.1234: S, cksum 0x7f36 (correct), 638609563:638609563(0) win 5840 <mss 1460,sackOK,timestamp 158734987 0,nop,wscale 6>
22:13:55.063150 IP (tos 0x10, ttl 64, id 29201, offset 0, flags [DF], proto TCP (6), length 60) 10.2.9.65.54322 > 10.2.9.5.1234: S, cksum 0x7c48 (correct), 638609563:638609563(0) win 5840 <mss 1460,sackOK,timestamp 158735737 0,nop,wscale 6>
22:14:01.059150 IP (tos 0x10, ttl 64, id 29202, offset 0, flags [DF], proto TCP (6), length 60) 10.2.9.65.54322 > 10.2.9.5.1234: S, cksum 0x766c (correct), 638609563:638609563(0) win 5840 <mss 1460,sackOK,timestamp 158737237 0,nop,wscale 6>
22:14:13.063149 IP (tos 0x10, ttl 64, id 29203, offset 0, flags [DF], proto TCP (6), length 60) 10.2.9.65.54322 > 10.2.9.5.1234: S, cksum 0x6ab4 (correct), 638609563:638609563(0) win 5840 <mss 1460,sackOK,timestamp 158740237 0,nop,wscale 6>Видно, что ходят только SYN-пакеты. Не могу понять, где я накосячил.
