Find the answer to your Linux question:
Results 1 to 5 of 5

Thread: dnat rule

Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1

    dnat rule

    Hello everybody,
    trying to understand the function of iptables I read this tutorial: Sorry it is in German, but anyway, the rule that puzzles me is the following:

    iptables -A FORWARD -p tcp -d --dport 80 -j ACCEPT
    iptables -t nat -A PREROUTING -i $IF_INET -p tcp -d $IF_INET_IP --dport 80 -j DNAT --to

    $IF_INET_IP is apparently the IP address of the wan/external nic

    I thought that the eth0 and the IP address of the wan were the same, but then the above rule wouldn't make any sense to me. What am I missing here?

    Thanks and regards!
    Ueli Strasser

  2. #2
    Linux Engineer Kieren's Avatar
    Join Date
    Aug 2007
    eth0 is the device. If you have 2 network cards they would be called something like eth0 and eth1. Each of these interfaces are also assigned an IP address.

    The second of your rules causes your computer to act like a router does. It is re-routing packets that are destined to go to $IF_INET_IP on port 80 to go to on port 80 instead. The -i $IF_INET part means that this rule will only occur if the packets are coming in on your eth0 device.
    Linux User #453176

  3. #3
    Thanks for your quick reply: I would think that most of the time $IF_INET and $IF_INET_IP are the same. What is the reason that this command wants these two different parameters if they are the same? In order to control the input when more than one IP address is assigned to this interface?
    How should I conceive eth0, eth1 and so on, as far as input is cencerned? As a sort of sink? And all packets that can reach it are processed?

    An explanation or directions where I can find docs about this would be highly appreciated as I think understanding above concepts are very important in order to be able to set up the rules correctly!

    Again thanks and regards
    Ueli Strasser

  4. $spacer_open
  5. #4
    Linux Engineer Kieren's Avatar
    Join Date
    Aug 2007
    Imagine that the above rule is used on a computer with two Ethernet cards, eth0 and eth1.

    eth0 is connected to the internet
    eth1 is connected to your home network

    The above rule is looking out for all packets that arrive at eth0 (-i $IF_INET) with the destination of $IF_INET_IP (-d $IF_INET_IP) and changing the destination of that packet to be instead (-j DNAT --to

    If you had 2 computers on your home network with the IP address' and you could write a similar rule to direct all the traffic that's meant to go to to instead go to like this:

    iptables -t nat -A PREROUTING -i eth0 -d -j DNAT --to

    As for books and tutorials I just learnt by searching Google and getting help from these Forums
    Linux User #453176

  6. #5
    Fernet17, your question about the rule parameters for IF_NET and IF_NET_IP:

    As you've already noted - IF_NET refers to the physical interface name while the IF_NET_IP refers to an IP address. These are NOT the same thing.

    What this rule is doing is commonly called a "sanity check" - it is double checking that a packet coming in to IF_NET_IP ONLY comes in through the eth0 device. This is required/expected if eth0 is connecting externally.

    This helps to filter/block any bad programming or hacking attempts where one might try to trick the firewall into letting your bad packet through by creating packets that say they are from an external IP while physically coming into say eth1 (a NIC connected to an internal network.)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts