We're seeking help please with finding examples or tutorials on the
following, which must be quite common: we wish to accept connections from
external specific IP address ranges to a certain port on an internal
machine.

What syntax is required to allow a machine w.x.0.0/16 to connect to our
external iptables eth1 = a.b.c.126:8317 (e.g. "security by obscurity") and
be forwarded to 10.0.0.9:443 where other AUTH security checks exist,
please?

What syntax is required to allow a machine w.x.0.0/16 to connect to
our external iptables eth1 = a.b.c.126:8317 (e.g. "security by
obscurity") and be forwarded to 10.0.0.9:443 where other AUTH
security checks exist, please?

Two parts are required here - one for the filter to let packets come
in: *filter
...
-A INPUT -i eth1 -s w.x.0.0/16 --dport 8317 -m state --state NEW -j
ACCEPT ...
COMMIT

and one to nat this connection to the internal machine and port:
*nat
...
-A PREROUTING -i eth1 -s w.x.0.0/16 --dport 8317 -j DNAT
--to-destination
10.0.0.9:443
...
COMMIT

On a side note: I guess this is about HTTPS on TCP, so you could add
"-p tcp --syn" to both rules right behind "--dport 8317". That would
filter out unwanted UDP traffic and TCP packets commonly not used to
establish connections.

ynotssor wrote:

Two parts are required here - one for the filter to let packets come in:
*filter
...
-A INPUT -i eth1 -s w.x.0.0/16 --dport 8317 -m state --state NEW -j ACCEPT

and one to nat this connection to the internal machine and port:
*nat
...
-A PREROUTING -i eth1 -s w.x.0.0/16 --dport 8317 -j DNAT --to-destination
10.0.0.9:443

On a side note: I guess this is about HTTPS on TCP, so you could add "-p
tcp --syn" to both rules right behind "--dport 8317".

Thank you so much. Per your assistance I currently have:

# cat /etc/sysconfig/iptables
*filter
:FORWARD ACCEPT [0:0]
:INPUT DROP [eth1:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -j ACCEPT
Hint: Put this rule behind the next so you don't waste time on checking

-A INPUT -i eth1 -s w.x.0.0/16 --dport 8317 -p tcp --syn -m state --state
NEW -j ACCEPT
-A INPUT -m state -i eth1 --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state -i eth1 --state NEW -j LOG --log-level 7 --log-prefix
UNSOLICITED:
COMMIT
*mangle
:PREROUTING ACCEPT [1471:303908]
:INPUT ACCEPT [636:240607]
:FORWARD ACCEPT [832:63181]
:OUTPUT ACCEPT [437:39285]
:POSTROUTING ACCEPT [1269:102466]
COMMIT
*nat
This should go after ":OUTPUT ACCEPT" but before "-A POSTROUTING ..."
-A PREROUTING -i eth1 -s w.x.0.0/16 --dport 8317 -p tcp --syn -j
DNAT --to-destination 10.0.0.9:443
:PREROUTING ACCEPT [203:14045]
:POSTROUTING ACCEPT [192:12653]
:OUTPUT ACCEPT [20:1217]
-A POSTROUTING -o eth1 -j MASQUERADE
COMMIT

# /etc/init.d/iptables restart
Flushing firewall rules: [ OK ]
Setting chains to policy ACCEPT: nat mangle filter [ OK ]
Unloading iptables modules: [ OK ]
Applying iptables firewall rules: iptables-restore v1.3.5: Unknown arg
`--dport'
Error occurred at line: 7
Try `iptables-restore -h' or 'iptables-restore --help' for more
information.
[FAILED]

Felix Tiede <f.tiede at (no spam) web.de> wrote:
ynotssor wrote:

Two parts are required here - one for the filter to let packets come in:
*filter
...
-A INPUT -i eth1 -s w.x.0.0/16 --dport 8317 -m state --state NEW -j
ACCEPT

If I understodd the question right, 10.0.0.9 isn't on the firewall
itself. So you probably want:

-A FORWARD -i eth1 -s x.y.0.0./16 -d 10.0.0.9/32 -p tcp --dport 443 -m
state --state NEW -j ACCEPT

[snip]
On a side note: I guess this is about HTTPS on TCP, so you could add "-p
tcp --syn" to both rules right behind "--dport 8317".

Why adding --syn? The filter rule is stateful.

Ah yes, sometimes I forget about the importance of argument order for
iptables. And since --dport is protocol dependant (not every protocol
filtered by iptables has source and or destination port), it is
necessary to specify "-p tcp" _before_ "--dport". That should do the
trick.
For readability of the script you can still stick "-p tcp" and "--syn"
together, and for even more so, put "-p tcp --syn" before "-s
w.x.0.0/16".

We're seeking help please with finding examples or tutorials on the
following, which must be quite common: we wish to accept connections from
external specific IP address ranges to a certain port on an internal
machine.

What syntax is required to allow a machine w.x.0.0/16 to connect to our
external iptables eth1 = a.b.c.126:8317 (e.g. "security by obscurity") and
be forwarded to 10.0.0.9:443 where other AUTH security checks exist,
please?

The iptables firewall currently drops all but RELATED, ESTABLISHED on
external eth1 and logs all unsolicited packets (we have that under
control, thanks):

# Generated by iptables-save v1.3.5 on Sun Mar 2 18:01:01 2008
*filter
:FORWARD ACCEPT [0:0]
:INPUT DROP [eth1:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state -i eth1 --state NEW -j LOG --log-level 7 --log-prefix
UNSOLICITED:
COMMIT
*mangle
:PREROUTING ACCEPT [1471:303908]
:INPUT ACCEPT [636:240607]
:FORWARD ACCEPT [832:63181]
:OUTPUT ACCEPT [437:39285]
:POSTROUTING ACCEPT [1269:102466]
COMMIT
*nat
:PREROUTING ACCEPT [203:14045]
:POSTROUTING ACCEPT [192:12653]
:OUTPUT ACCEPT [20:1217]
-A POSTROUTING -o eth1 -j MASQUERADE
COMMIT

I think you are saying you want to route incoming traffic arriving on
eth1 from network a.b.c.d to eth0 which is network 10.0.0.X but only
from a single IP on the a.b.c.d network
Something like this (may not be exactly right):
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s a.b.c.126 --sport 8317
-d 10.0.0.9 --dport 443 -j ACCEPT

In news:6h7517FjhtbbU1 at (no spam) mid.individual.net,
Felix Tiede <f.tiede at (no spam) web.de> typed:

Ah yes, sometimes I forget about the importance of argument order for
iptables. And since --dport is protocol dependant (not every protocol
filtered by iptables has source and or destination port), it is
necessary to specify "-p tcp" _before_ "--dport". That should do the
trick.
For readability of the script you can still stick "-p tcp" and "--syn"
together, and for even more so, put "-p tcp --syn" before "-s
w.x.0.0/16".

Thank you Mssrs. Tiede and Potter at (no spam) . I now have:

# cat /etc/sysconfig/iptables
*filter
:FORWARD ACCEPT [0:0]
:INPUT DROP [eth1:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -j ACCEPT
-A INPUT -m state -i eth1 --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -p tcp --syn -s w.x.0.0/16 -d 10.0.0.9/32 --dport 443
-m state --state NEW -j ACCEPT
-A INPUT -m state -i eth1 --state NEW -j LOG --log-level 7 --log-prefix
UNSOLICITED:
COMMIT
*mangle
:PREROUTING ACCEPT [1471:303908]
:INPUT ACCEPT [636:240607]
:FORWARD ACCEPT [832:63181]
:OUTPUT ACCEPT [437:39285]
:POSTROUTING ACCEPT [1269:102466]
COMMIT
*nat
:PREROUTING ACCEPT [203:14045]
:POSTROUTING ACCEPT [192:12653]
:OUTPUT ACCEPT [20:1217]
-A PREROUTING -i eth1 -p tcp --syn -s w.x.0.0/16 -d 10.0.0.9/32 --dport
8317 -j DNAT --to-destination 10.0.0.9:443
-A POSTROUTING -o eth1 -j MASQUERADE
COMMIT

Leave out the "-d 10.0.0.9/32" from the PREROUTING rule. In that
state of natting, iptables doesn't know the final address (which is
going to be changed to 10.0.0.9) so it doesn't nat the packet and the
FORWARD chain won't match.

*filter
:FORWARD ACCEPT [0:0]

-A INPUT -i eth1 -p tcp --syn -s w.x.0.0/16 --dport 8317 -m state --state

If I understodd the question right, 10.0.0.9 isn't on the firewall
itself. So you probably want:

-A FORWARD -i eth1 -s x.y.0.0./16 -d 10.0.0.9/32 -p tcp --dport 443 -m
state --state NEW -j ACCEPT

-A PREROUTING -i eth1 -s w.x.0.0/16 --dport 8317 -j DNAT --to-destination
10.0.0.9:443

Just a small improvement, but accurateness adds security.

-A PREROUTING -i eth1 -s x.y.0.0/16 -d a.b.c.d/32 -p tcp --dport 8317 -j
DNAT --to-destination 10.0.0.9:443

harry.potter at (no spam) fredastaire.ch wrote:

On a side note: I guess this is about HTTPS on TCP, so you could add "-p
tcp --syn" to both rules right behind "--dport 8317".

Why adding --syn? The filter rule is stateful.

Stateful inspection costs time by checking tables. --syn is information the
packet already carries with itself and by checking it first unwanted
traffic will be filtered before costly stateful inspection - that is, if
order of checking (and not checking anymore after first failure) is as
specified on commandline...

We're seeking help please with finding examples or tutorials on the
following, which must be quite common: we wish to accept connections from
external specific IP address ranges to a certain port on an internal
machine.

What syntax is required to allow a machine w.x.0.0/16 to connect to our
external iptables eth1 = a.b.c.126:8317 (e.g. "security by obscurity") and
be forwarded to 10.0.0.9:443 where other AUTH security checks exist, please?

The iptables firewall currently drops all but RELATED, ESTABLISHED on
external eth1 and logs all unsolicited packets (we have that under control,
thanks):