iptables – allow access to a web server from the outside

Posted on

Problem :

I am trying to allow access to a web server from the outside and I am getting nowhere. Granted I do not have any experience in iptables, but I have dabbled in Cisco ACL and NAT.

I am not sure what I have wrong and I am hoping someone can steer me in the right direction.

here is my config:

iptables -t nat -A PREROUTING -p tcp -i wan0 --dport 8060 -j DNAT --to-destination %webserver%:8060
iptables -t nat -A PREROUTING -p tcp -i wan0 --dport 554 -j DNAT --to-destination %webserver%:554
iptables -t filter -A FORWARD -p tcp -d %webserver% --dport 8060 -j ACCEPT
iptables -t filter -A FORWARD -p tcp -s %webserver% --sport 8060 -j ACCEPT
iptables -t nat -A POSTROUTING -o wan0 -j MASQUERADE

Solution :

check your iptables and make sure you have added rule for NEW , RELATED, ESTABLISHED . also check you default gateway is ok .

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state NEW -j ACCEPT
iptables -I INPUT -i lo -j ACCEPT
iptables -A INPUT -i wan0 -p tcp --dport 8060 -j ACCEPT
iptables -A INPUT -i wan0 -p tcp --dport 554 -j ACCEPT
iptables -I FORWARD -i wan0 -o virbr0(change) -p tcp -m state --state NEW -j ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP

Leave a Reply

Your email address will not be published. Required fields are marked *