iptables DNAT on smb port failed, hits on PREROUTING, but no on POSTROUTING

li_jessen

12/21/23, 3:20 AM

I'm running Ubuntu 20.04. It works well by forwarding http requests directed at port 8080 of the local machine to another machine's port 80. But when I set iptables rules to forward smb requests directed at a local machine to another machine running a smb server, it failed. There are only hits in PREROUTING, but no in POSTROUTING. The iptables commands are the following:

sudo iptables -t nat -A PREROUTING -p tcp --match multiport --dports 445,137,138,139 -j DNAT --to-destination 192.168.10.162
sudo iptables -t nat -A POSTROUTING -d 192.168.10.162 -j MASQUERADE

After running $sudo iptables -t nat -L -v, it shows the following:

Chain PREROUTING (policy ACCEPT 3981 packets, 847K bytes)
 pkts bytes target     prot opt in     out     source               destination
   60  3156 DNAT       tcp  --  any    any     anywhere             anywhere             multiport dports netbios-ns,netbios-dgm,netbios-ssn,microsoft-ds to:192.168.10.162

Chain INPUT (policy ACCEPT 604 packets, 86773 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 57 packets, 4781 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 57 packets, 4781 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  any    any     anywhere             192.168.10.162

The Ubuntu 20.04 connects to a switch which connects to another switch to which the other Linux machine connects to. I use a Win10 PC connected to the same switch as Ubuntu 20.04 does to visit Ubuntu 20.04.

149

1 + 1

nat

iptables

dnat

Tero Kilkanen

12/21/23, 7:12 AM

Please show network topology between the client and server.

Score:0

Server

li_jessen

12/27/23, 2:08 AM

I'm sorry to tell you all that I made a low-level mistake. I forgot to enable IPFORWARD in the Linux machine. After I run

sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"

It works.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: iptables DNAT on smb port failed, hits on PREROUTING, but no on POSTROUTING

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.