Forwarding to mail server : problem accessing from local network

Marine · *nix forums beginner Joined: 18 Jul 2006 Posts: 3

I endly found the solution to my problem on another post :
http://groups.google.fr/group/comp.os.linux.security/browse_frm/thread/24087aba89e91579/50e3469988bbc8c5?lnk=st&q=iptables%20forward%20works%20from%20internet%20not%20from%20local&rnum=6&hl=fr#50e3469988bbc8c5

You were rigth, I had to add another iptables rule :
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source
84.xxx.xxx.xxx

Thanks for your help.

Marine a écrit :

Marine · *nix forums beginner Joined: 18 Jul 2006 Posts: 3

Thanks for your response.

I will study again kerrocher's iptables rules, but I don't think I have
anything else to specify, because I configured other forwarding rules
that work that way.

If I change the "hosts" file on Win XP to resolve domain, would I put
192.168.0.1 or 192.168.30 ?
To me, the IP that should respond to my domain is 192.168.0.1. And it
works today.

I would rather think that "amd64" doesn't accept response from
"debian". In amd64's firewall, I saw some ICMP packets from
192.168.0.99 to 192.168.0.20 being blocked.

Could it be the problem ?
I exited amd64's firewall, but it doesn't work anyway.

alberto.moruno@gmail.com a écrit :

alberto.moruno@gmail.com · *nix forums beginner Joined: 18 Jul 2006 Posts: 3

more simply, change your local file hosts in
WINDOWS\system32\drivers\etc for resolve domain to local ip

alberto.moruno@gmail.com wrote:

alberto.moruno@gmail.com · *nix forums beginner Joined: 18 Jul 2006 Posts: 3

I think that yo need more rules. Its possible you need accept traffic
from 0.1 to 0.30.

KaiCoM

Marine wrote:

Marine · *nix forums beginner Joined: 18 Jul 2006 Posts: 3

(For english message, please see below)
Bonjour,

Voici la configuration de mon réseau local

- Un serveur sous Linux Mandriva 2005 : nom = kerrocher, IP 192.168.0.1
relié à Internet avec une adresse IP publique (84.xxx.xxx.xxx), et
un nom de domaine (mon_domaine)
- Un PC sous Windows XP : nom = "amd64", IP = 192.168.0.20
- Un serveur mail sous Linux Debian/Postfix : nom = "debian", IP 192.168.0.30

Sur le serveur "kerrocher", j'ai configuré le firewall avec iptables
pour rediriger les requetes destinees a "kerrocher"/ports 25 et 110
vers "debian" :

iptables -t nat -A PREROUTING -p tcp -d 192.168.0.1 -m multiport
--dports smtp,pop3,imap -j DNAT --to-destination 192.168.0.30
iptables -t nat -A PREROUTING -p tcp -d 84.xxx.xxx.xxx -m multiport
--dports smtp,pop3,imap -j DNAT --to-destination 192.168.0.30

Cela fonctionne bien quand je me connecte à "mon_domaine" de Outlook
Express à partir d'un poste sur Internet.
Par contre, quand j'essaie de me connecter à "mon_domaine" de Outlook
Express à partir de amd64 (mon PC local sous Win XP), ca ne fonctionne
pas.
Quand j'essaie de me connecter à "debian" de Outlook Express à partir
de amd64, ca fonctionne.

J'ai essayé ceci sur amd64 :
telnet 192.168.0.30 110 => OK
telnet 192.168.0.30 25 => OK
telnet 192.168.0.1 110 => -ERR AVG POP3 Proxy Server: Cannot
connect to the mail server!
telnet 192.168.0.1 25 => Connexion à
192.168.0.1...Impossible d'ouvrir une connexion à l'hôte, sur le port
25: Échec lors de la connexion

Je pensais que mes règles iptables de forward n'étaient pas
correctes, j'ai donc activé les logs iptables. Mais ca me semble
pourtant correct.
Voici les logs que je récupère quand je fait un "telnet 192.168.0.30
110" :

- Sur kerrocher, 1 seul ligne :
Jul 17 20:55:31 kerrocher kernel: [IPT_PST_eth1] IN= OUT=eth1
SRC=192.168.0.20 DST=192.168.0.30 LEN=48 TOS=0x00 PREC=0x00 TTL=127
ID=6328 DF PROTO=TCP SPT=3195 DPT=110 WINDOW=65535 RES=0x00 SYN URGP=0

- Sur debian, lignes répétées plusieurs fois :
Jul 17 20:55:54 localhost kernel: [IPT_IN eth0] IN=eth0 OUT= MAC=(...)
SRC=192.168.0.20 DST=192.168.0.30 LEN=48 TOS=0x00 PREC=0x00 TTL=127
ID=5039 DF PROTO=TCP SPT=3184 DPT=110 WINDOW=65535 RES=0x00 SYN URGP=0
Jul 17 20:55:54 localhost kernel: [IPT_OUT eth0] IN= OUT=eth0
SRC=192.168.0.30 DST=192.168.0.20 LEN=48 TOS=0x00 PREC=0x00 TTL=64 ID=0
DF PROTO=TCP SPT=110 DPT=3184 WINDOW=5840 RES=0x00 ACK SYN URGP=0

Quelqu'un aurait-il un idée sur mon problème ?
Merci d'avance
Marine

------------------------------------------------------------------------------------------------------------------------------------

Hello,

Here is my local network :

- A server under Linux Mandriva 2005 : name = kerrocher, IP 192.168.0.1
connected on the Internet with a public IP (84.xxx.xxx.xxx), and
having a domain name (my_domain)
- A PC under Windows XP : name = "amd64", IP = 192.168.0.20
- A Mail server under Linux Debian/Postfix : name = "debian", IP 192.168.0.30

On "kerrocher" server, I configured iptables like this : requests to
ports 25 and 110 of "kerrocher" are forwarded to "debian" :

iptables -t nat -A PREROUTING -p tcp -d 192.168.0.1 -m multiport
--dports smtp,pop3,imap -j DNAT --to-destination 192.168.0.30
iptables -t nat -A PREROUTING -p tcp -d 84.xxx.xxx.xxx -m multiport
--dports smtp,pop3,imap -j DNAT --to-destination 192.168.0.30

It works well when I connect to "my_domain" from Outlook Express from
Internet.
But when I try to connect to "my_domain" from Outlook Express on amd64
(my Win XP local PC), it doesn't work.
When I try to connect to "debian" from Outlook Express on amd64, it
works.

I tried this on amd64 :
telnet 192.168.0.30 110 => OK
telnet 192.168.0.30 25 => OK
telnet 192.168.0.1 110 => -ERR AVG POP3 Proxy Server: Cannot
connect to the mail server!
telnet 192.168.0.1 25 => Connexion à
192.168.0.1...Impossible d'ouvrir une connexion à l'hôte, sur le port
25: Échec lors de la connexion

I thougth my forwarding iptables rules were wrong on local network. So
I put iptables logs. But It seems to be correct.
Here are the iptables logs when I try a "telnet 192.168.0.30 110" :

- On kerrocher, only one line :
Jul 17 20:55:31 kerrocher kernel: [IPT_PST_eth1] IN= OUT=eth1
SRC=192.168.0.20 DST=192.168.0.30 LEN=48 TOS=0x00 PREC=0x00 TTL=127
ID=6328 DF PROTO=TCP SPT=3195 DPT=110 WINDOW=65535 RES=0x00 SYN URGP=0

- On debian, theses lines repeated serveral times :
Jul 17 20:55:54 localhost kernel: [IPT_IN eth0] IN=eth0 OUT= MAC=(...)
SRC=192.168.0.20 DST=192.168.0.30 LEN=48 TOS=0x00 PREC=0x00 TTL=127
ID=5039 DF PROTO=TCP SPT=3184 DPT=110 WINDOW=65535 RES=0x00 SYN URGP=0
Jul 17 20:55:54 localhost kernel: [IPT_OUT eth0] IN= OUT=eth0
SRC=192.168.0.30 DST=192.168.0.20 LEN=48 TOS=0x00 PREC=0x00 TTL=64 ID=0
DF PROTO=TCP SPT=110 DPT=3184 WINDOW=5840 RES=0x00 ACK SYN URGP=0

Has anybody any idea about this problem ?
Thank you.
Marine

Google