Please help me with port forward using centos as afrihost static ip gateway

K

Kameelperdza

Well-Known Member
Joined
Jan 15, 2009
Messages
343
Reaction score
0
Location
Oudtshoorn
Hi people.

I have managed to setup xl2tp on my centos 6 server to make connection to afrihost static ip .

Now im stuck and don't know what I must do next.

Basically all I want to use the centos for it to forward certain ports between the static ip and my network.

Can someone please assist me with this.

My lan ip address is 192.168.0.0/24 and I see that ppp0 shows my static Ip address.
 
Hi There

Paste your current iptables here please. Command below:
"cat /etc/sysconfig/iptables"
 
re

Murlin said:
Hi There

Paste your current iptables here please. Command below:
"cat /etc/sysconfig/iptables"
Click to expand...

Hi there thank you for your reply.

Here it is

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
 
Kameelperdza said:
Hi there thank you for your reply.

Here it is

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
Click to expand...

Heres an example to help you.

# Generated by iptables-save v1.4.7 on Thu Jun 4 10:55:33 2015
*nat
:PREROUTING ACCEPT [1203584:79254591]
:POSTROUTING ACCEPT [253245:18232632]
:OUTPUT ACCEPT [249067:18024872]
-A PREROUTING -i eth1 -p tcp -m tcp --dport 1433 -j DNAT --to-destination 192.168.0.1:1433
-A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.1:80
-A PREROUTING -i eth1 -p tcp -m tcp --dport 14330:14340 -j DNAT --to-destination 192.168.0.1:14330-14340
-A POSTROUTING -s 192.168.0.0/24 -o eth1 -j MASQUERADE
COMMIT
# Completed on Thu Jun 4 10:55:33 2015
# Generated by iptables-save v1.4.7 on Thu Jun 4 10:55:33 2015
*filter
:INPUT ACCEPT [132378:22056935]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [21543441:18221133884]
:NO - [0:0]
-A INPUT -i eth0 -j ACCEPT
-A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -j NO
-A FORWARD -d 192.168.0.1/32 -i eth1 -p tcp -m tcp --dport 1433 -j ACCEPT
-A FORWARD -s 192.168.0.1/32 -i eth0 -p tcp -m tcp --sport 1433 -j ACCEPT
-A FORWARD -d 192.168.0.1/32 -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -s 192.168.0.1/32 -i eth0 -p tcp -m tcp --sport 80 -j ACCEPT
-A FORWARD -d 192.168.0.1/32 -i eth1 -p tcp -m tcp --dport 14330:14340 -j ACCEPT
-A FORWARD -s 192.168.0.1/32 -i eth0 -p tcp -m tcp --sport 14330:14340 -j ACCEPT
-A FORWARD -s 192.168.0.0/24 -i eth0 -p tcp -m tcp --dport 143 -j ACCEPT
-A FORWARD -s 192.168.0.0/24 -i eth0 -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -s 192.168.0.0/24 -i eth0 -p tcp -m tcp --dport 465 -j ACCEPT
-A FORWARD -s 192.168.0.0/24 -i eth0 -p tcp -m tcp --dport 587 -j ACCEPT
-A FORWARD -s 192.168.0.0/24 -i eth0 -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -s 192.168.0.0/24 -i eth0 -p tcp -m tcp --dport 995 -j ACCEPT
-A FORWARD -s 192.168.0.0/24 -i eth0 -p tcp -m tcp --dport 993 -j ACCEPT
-A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j NO
-A NO -j LOG --log-level 6
-A NO -j DROP
COMMIT
# Completed on Thu Jun 4 10:55:33 2015

eth0 being the internal interface
eth1 being the network card to the ADSL
ppp+ sounds like the option for you as you doing a pppoe on the server

From here, you should be able to "tail -f /var/log/messages" . This will show you the packets getting blocked.
It may be easier for you to install webmin which is available in rpm format from www.webmin.com . You will be able to get a GUI of the firewall
 
re

I added the rules and changed the eth1 to ppp0, also change ip address 192.168.0.1 to internal ip I want to forward to.

But stil cannot connect from ouside.

The ppp0 connection on my centos is l2tp.


Here is my route table

Code: 
[root@staticip ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
196.7.106.11    0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1003   0        0 eth1
0.0.0.0         192.168.0.2     0.0.0.0         UG    0      0        0 eth0
[root@staticip ~]#
 
Kameelperdza said:
I added the rules and changed the eth1 to ppp0, also change ip address 192.168.0.1 to internal ip I want to forward to.

But stil cannot connect from ouside.

The ppp0 connection on my centos is l2tp.


Here is my route table

Code: 
[root@staticip ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
196.7.106.11    0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1003   0        0 eth1
0.0.0.0         192.168.0.2     0.0.0.0         UG    0      0        0 eth0
[root@staticip ~]#
Click to expand...

Your gateway needs to be on the eth1 which should be set by the ppp0. I suspect the eth0 config has a gateway set.
 
if I remove gateway then l2tp cannot make connection.

Is it possible to allow only 1701udp to use gateway 192.168.0.2 and let all other ports use ppp0 as gateway?
 
Kameelperdza said:
if I remove gateway then l2tp cannot make connection.

Is it possible to allow only 1701udp to use gateway 192.168.0.2 and let all other ports use ppp0 as gateway?
Click to expand...

Ideally you want the ADSL router on its own network card. So eth1 connected to the ADSL router. Eth0 connected to switch. Then you firewall between the two devices and incomming connections from the outside. It sounds like you setup needed is far from standard.

You can route different ports out different gateways but this requires packet marking and a solid understanding of IPTABLES. If this is going to become permanent and is for a business, I would advise you contact a Linux company. I wouldn't be surprised if botnet servers haven't already tried some logins on port 22 to your server.
 
Im using mikrotik for all my pppoe connections, but afrihost static ip needs secret that mikrotik does not support.

Another option is to buy one of those expensive adsl routers afrihost suggest.

All I want the use the centos for is to allow connection from internet side using the static Ip address allocated to me.
 
Kameelperdza said:
Im using mikrotik for all my pppoe connections, but afrihost static ip needs secret that mikrotik does not support.

Another option is to buy one of those expensive adsl routers afrihost suggest.

All I want the use the centos for is to allow connection from internet side using the static Ip address allocated to me.
Click to expand...
Have you engaged with mikrotik about this? I'm sure they'd look at implementing standards that they are missing...
 
Hi there, I have changed my my server setup and connected eth1 to the modem. The modem already have pppoe setup so I did not need to setup pppoe on centos.
I think I might have found my solution here, http://mybroadband.co.za/vb/showthread.php/651406-Afrihost-Axxess-Static-IP-address-using-Linux. I have added route add 196.30.121.50 gw 192.168.0.1 and now centos only uses gateway for 196.30.121.50.

I will check later if everything work. Afrihost having auth problems at the moment.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X