Forwarding port 80 from firewall to intranet server

[Nandy]

I have Red Hat linux 6.2 and i am trying to forward the request on port 80 on the firewall to the intranet server i have. All i have been able to find is the following rules:
#this will redirect all web conections (port 80) to you intenal server (using the tcp protocal (proto))
ipmasqadm portfw -a -P tcp -L $SERVER_IP 80 -R $EXTERNAL_NET 80

#this will redirect timed connections
ipmasqadm portfw -a -P udp -L 525 -R $EXTERNAL_NET 525

ipmasqadm portfw -l

The problem is that the system does not find ipmasqadm. Is that what it was used on old kernel? Should i replace ipmasqadm and portfr for ipchains and forward?

Can anybody tell me or give me and example on how to achieve this?

Thanks,
Nandy

[scottt]

You need to have forwarding compiled into your kernel.

Here's some helpful info

Sources:
IP-MASQUERADING Howto http://www.linuxdoc.org/HOWTO/IP-Masquerade-HOWTO.html
IPCHAINS Howto http://www.linuxdoc.org/HOWTO/IPCHAINS-HOWTO.html

Modules needed:

Loadable kernel modules
ftp://ftp.ocs.com.au/pub/modutils/v2.3/modutils-2.3.14-1.i386.rpm

TCP/IP port-forwarders http://juanjox.kernelnotes.org/ipmasqadm-0.4.2-2.i386.rpm (glibc2 rpm)

Make sure kernel is compiled for forwarding.

In your firewall script add these lines to the appropriate section:

#Input:
#-------------
/sbin/ipchains -A input -j ACCEPT -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 ftp

#Output:
#-------------
/sbin/ipchains -A output -j ACCEPT -p tcp -s $EXTIP ftp -d 0.0.0.0/0

(Note: this opens up ftp to the world. if you want to allow an explicit host change the IP addy to suit your needs $EXTIP needs to be your external ip addy)

Add a forwarding section to your firewall script:

# Forwarding:
#----------------------------------
# Port Forwarding
/usr/sbin/ipmasqadm portfw -f
/usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTIP 80 -R $PORTFWIP1 80

(where $EXTIP is the firewalls External IP and $PORTFWIP1 is the internal server ip you want requests forwarded to)

Hope this helps
Cheers,
Scott

[Nandy]

I realized later last night that ipmasqadm does not comes included on the linux distro i have. I downloaded and make sure the install whent ok. I tried the example on this page: http://www.ox.compsoc.org.uk/~steve/portfw-2.2.html

I used:

#this will clear all previous port forward rules
ipmasqadm portfw -f

#this will redirect all web conections (port 80) to you intenal server (using th
e tcp protocal (proto))
ipmasqadm portfw -a -P tcp -L 192.XXX.X.X 80 -R $EXTERNAL_NET 80

#this will redirect timed connections
ipmasqadm portfw -a -P udp -L 192.XXX.X.X 525 -R $EXTERNAL_NET 525

#ipmasqadm portfw -l

this is the port forwarding list table

prot localaddr rediraddr lport rport pcnt pref
UDP linux.quinonesfamily.com clt25-83-157.carolina.rr.com 525 525
10 10
TCP linux.quinonesfamily.com clt25-83-157.carolina.rr.com www www
10 10

Then i tried to access the server from my job but it failed to connect.

I tried your example after commenting out the previous conf:

#Input:
#-------------
/sbin/ipchains -A input -j ACCEPT -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 http

#Output:
#-------------
/sbin/ipchains -A output -j ACCEPT -p tcp -s $EXTERNAL_NET http -d 0.0.0.0/0


#forwarding:
#----------------------------------
# Port Forwarding
/usr/sbin/ipmasqadm portfw -f
/usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTERNAL_NET 80 -R 192.XXX.X.X 80


This is the port fowarding list table

prot localaddr rediraddr lport rport pcnt pref
TCP clt25-83-157.carolina.rr.com linux.quinonesfamily.com www www
10 10


But i havent been able to try it, since the only pc i have with modem i loaned to my syster-in-law. BTW the server is running ok, i can access it's contain from the intranet.

Any ideas?

Nandy

[routeme]

What you did should be working. I did the same thing except I forwarded port 98 to an internal windows machine. I could not view internally though, from any computer. I had to dial up or go somewhere else.

[routeme]

http://www.linuxnewbie.org/ubb/Forum13/HTML/002378.html

[Nandy]

Well it is working now, i had the ipaddrs inverse with the local address....

It is working!!! Thanks to you all for the help!

Nandy