[Firehol-support] Port forwarding failing, probably configuration error.

Mark rider at ridersoft.net
Sun Feb 7 18:27:32 GMT 2016


I've gotten some advice left and right, thank you, but still not working 
as desired.

I've manually managed it now, via this, working from outside ip;

iptables -A PREROUTING -t nat -i eth4 -p tcp --dport 88 -j DNAT --to 
192.168.40.55:88
iptables -A FORWARD -p tcp -d 192.168.40.55 --dport 88 -j ACCEPT

But cannot find the equivalent configuration options in firehol

The connections are such

Internet/Browser
  |
eth4, internet facing device on public IP on port 88
  |
br0 - Bridged eth0 and tap0 device
  |
192.168.40.55, the camera

Testing is done via Telnet.

So, if I want port 88 to be forwarded all the way to the 192.168.40.55 
on the LAN, I need the appropiate server entry on the router. I tried 
doing that, my router entries are these;

# Allow routing for the lan
router lan2internet inface eth0 outface eth4
         masquerade
         client all      accept
         server all      accept

# Allow routing for the Bridge
router br2internet inface br0 outface eth4
         masquerade
         client all      accept
         server all      accept

# Allow routing for Bridge To Bridge
router br2br inface br0 outface br0
         policy accept
         server all      accept
         client all      accept

I still get the connection refused, from inside the LAN as well as from 
outside.

Mark schreef op 2016-02-03 18:12:
> I am trying to get a simple bit of portforwarding to work, but this is
> a new kind of frustrating, also because this it's the goram baby
> monitor and that fact does kinda put a little stress on me :)
> 
> I want all traffic coming in on port 88 on the firewall to go to an IP
> on the LAN at 192.168.40..55
> I've tried a whole list of things, but currently I keep getting this.
> 
> -------------------------
> root at ruby:/home/rider# telnet 83.84.x.x 88
> Trying 83.84.x.x...
> telnet: Unable to connect to remote host: Connection refused
> root at ruby:/home/rider# telnet 192.168.40.55 88
> Trying 192.168.40.55...
> Connected to 192.168.40.55.
> Escape character is '^]'.
> ^]
> 
> telnet> quit
> Connection closed.
> root at ruby:/home/rider#
> -------------------------
> 
> The forwarding doens't work, telnet directly does. This is the latest
> version of the configuration line I've used;
> 
> nat4 to-destination 192.168.40.55 proto tcp dport 88 dst 83.84.x.x
> 
> As far as I understand, this should work. But, I get connection
> refused. Can anyone tell me what the flaw in my logic is? After a few
> hours of this, I am beat.
> 
> Many thanks. The Firehol config is below this
> 
> -------------------------
> 
> # FireHOL configuration file
> #
> # See firehol.conf(5) manual page and FireHOL Manual for details.
> #
> # This configuration file will allow all requests originating from the
> # local machine to be send through all network interfaces.
> #
> # No requests are allowed to come from the network. The host will be
> # completely stealthed! It will not respond to anything, and it will
> # not be pingable, although it will be able to originate anything
> # (even pings to other hosts).
> #
> 
> version 6
> 
> FIREHOL_LOG_MODE="NFLOG"
> FIREHOL_LOG_LEVEL=6
> 
> FIREHOL_DROP_ORPHAN_TCP_ACK_FIN=1
> FIREHOL_LOG_DROP_INVALID=0
> 
> # My cool SSH thing
> server_SSHSafe_ports="tcp/6036"
> client_SSHSafe_ports="default"
> 
> # My cool SSH thing
> server_SSH_ports="tcp/22"
> client_SSH_ports="default"
> 
> server_SSH443_ports="tcp/443"
> client_SSH443_ports="default"
> 
> server_vent_ports="tcp/3784 udp/3784"
> client_vent_ports="default"
> 
> # VPN Server
> server_openvpn_ports="tcp/1194"
> client_openvpn_ports="default"
> 
> # IMAP SSL
> server_imapssl_ports="tcp/993"
> client_imapssl_ports="default"
> 
> # MySQL
> server_mysql_ports="tcp/3306"
> client_mysql_ports="default"
> 
> # Teampspeak
> server_teamspeak_ports="udp/8767"
> client_teamspeak_ports="default"
> 
> # rdp
> server_rdp_ports="tcp/3300"
> client_rdp_ports="default"
> 
> # IPCam
> server_ipcam_ports="tcp/88"
> client_ipcam_ports="default"
> 
> # voip
> server_voip_ports="udp/5060 tcp/5060"
> client_voip_ports="default"
> server_ts_ports="udp/9987"
> client_ts_ports="default"
> 
> # block
> server_blocker_ports="  tcp/23          udp/23
>                         tcp/57          udp/67
>                         tcp/68          udp/68
>                         tcp/111         udp/111
>                         tcp/135         udp/135
>                         tcp/137         udp/137
>                         tcp/138         udp/138
>                         tcp/139         udp/139
>                         tcp/445         udp/445
>                         tcp/1433        udp/1433
>                         tcp/1434        udp/1434
>                         tcp/2967        udp/2967
>                         tcp/5900        udp/5900
>                         tcp/6881        udp/6881
>                         tcp/3128        udp/3128
>                         tcp/59001       udp/59001"
> client_blocker_ports="default"
> 
> # My Internet Host Ziggo
> interface eth4 InetZiggo
>         policy drop
>         server ident reject with tcp-reset
> 
>         # I don't know why this doesn't work
>         # client multicast reject with proto-unreach
> 
>         server SSH              accept
>         server SSHSafe          accept
>         server SSH443           accept
>         server http             accept
>         server smtp             accept
>         server dns              accept
>         server openvpn          accept
>         server imapssl          accept
>         server icmp             accept
>         server ipcam            accept
>         server blocker          reject
> 
>         client  all             accept
>         server  all             reject
> 
> nat4 to-destination 192.168.40.55 proto tcp dport 88 dst 83.84.x.x
> 
> # Accept all on the Lan
> interface eth0 LAN
>         client all      accept
>         server all      accept
> 
> # Accept all on the Bridge
> interface br0 Bridge
>         client all      accept
>         server all      accept
> 
> # LXC Bridge
> interface lxcbr0 LXCBridge
>         policy accept
>         server all              accept
>         client all              accept
> 
> # LXC Nic
> interface veth+ LXCNIC
>         policy accept
>         server all              accept
>         client all              accept
> 
> # VPN Tap Device
> interface tap0 TapDecvice
>         policy accept
>         server  all             accept
>         client  all             accept
> 
> # Allow routing for the lan
> router lan2internet inface eth0 outface eth4
>         masquerade
>         client all      accept
>         server all      accept
> 
> # Allow routing for the Bridge
> router br2internet inface br0 outface eth4
>         masquerade
>         client all      accept
>         server all      accept
> 
> # Allow routing for Bridge To Bridge
> router br2br inface br0 outface br0
>         policy accept
> 
> # Allow all routing for inface lxcbr0
> router lx2veth inface lxcbr0 outface veth+
>         masquerade
>         server all      accept
>         client all      accept
> 
> router veth2lx inface veth+ outface lxcbr0
>         masquerade
>         client all      accept
>         server all      accept
> 
> _______________________________________________
> Firehol-support mailing list
> Firehol-support at lists.firehol.org
> http://lists.firehol.org/mailman/listinfo/firehol-support



More information about the Firehol-support mailing list