Forums

Subscribe via email Subscribe via email
Subscribe via rss
Guest
or Ask a Question
Add a reply View Replies (2) →
Jim Robinson
Jim Robinson
Offline
Task

Source IP Limiting 1-to-1 Port NAT Rule?

Resolved
0 votes
Hey Guys & Gals,

I have a need to source IP limit a 1-to-1 port NAT rule and was wondering how to go about it.
I have the rule built in the GUI - there is only one port/rule in play. I assume I have to have something in the GUI to build the Public IP bind. The rule works fine - the port/IP is available publicly as expected. What I would like to do is add a Custom rule to limit which public/source IPs can access this. Any help much appreciated:

0 0 DNAT udp -- * * 0.0.0.0/0 97.<sn.ip>.195 udp dpt:31199 to:10.103.1.3
0 0 SNAT udp -- * * 10.103.1.0/24 10.103.1.3 udp dpt:31199 to:10.103.1.254

0 0 ACCEPT icmp -- ens161 * 0.0.0.0/0 10.103.1.3 icmptype 0
0 0 ACCEPT icmp -- ens161 * 0.0.0.0/0 10.103.1.3 icmptype 3
0 0 ACCEPT icmp -- ens161 * 0.0.0.0/0 10.103.1.3 icmptype 8
0 0 ACCEPT icmp -- ens161 * 0.0.0.0/0 10.103.1.3 icmptype 11
0 0 DROP icmp -- ens161 * 0.0.0.0/0 10.103.1.3
14M 13G ACCEPT udp -- ens161 * 0.0.0.0/0 10.103.1.3 udp dpt:31199

Cheers!

Jim
1-1 NAT Port Forwarding Firewall Custom Firewall
In 1-to-1 NAT
Friday, August 25 2017, 03:34 PM
Subscribe via email
Share this post:

Accepted Answer

Nick Howitt
Nick Howitt
Offline
Sunday, August 27 2017, 07:19 AM - #Permalink
Resolved
0 votes
Hi Jim,
A couple of things come to mind using the custom firewall. Both use the fact that custom firewall rule get applied after 1-to-1 NAT and any other webconfig based firewall rules, so the idea would be to add a very similar rule to the PREROUTING or FORWARD rule with a "! -s your-wanted-source-ip" and drop all matching packeds. This won't work in the PREROUTING chain as you cannot DROP but you can redirect to a non-existent IP. So try something like this at the command line:
iptables -I PREROUTING -t nat ! -s your_wanted_source_ip -d your_WAN_IP -p udp --dport 31199 -j SNAT --to-destination your_black_hole_ip
For your black hole IP either use your LAN IP but make the last number a 0 or use an IP address in a completely different subnet, Alternatively use the FORWARD chain:
iptables -I FORWARD -i  ens161 ! -s your_wanted_source_ip -d 10.103.1.3 -p udp --dport 31199 -j DROP


Please try the rule at the command line first to see if there are errors. I may have my syntax a bit wrong, but I am away and can't easily test. If it works, put it in the custom firewall module, but change "iptables" to "$IPTABLES"
The reply is currently minimized Show
Responses (2)

  • Accepted Answer

    Nick Howitt
    Nick Howitt
    Offline
    Monday, August 28 2017, 08:36 PM - #Permalink
    Resolved
    0 votes
    Ah yes. The first rule should have been DNAT and not SNAT.
    The reply is currently minimized Show

  • Accepted Answer

    Jim Robinson
    Jim Robinson
    Offline
    Monday, August 28 2017, 07:31 PM - #Permalink
    Resolved
    0 votes
    Hey Nick,

    Thanks so much for the thoughts. Never could get the first rule to work - complained: ip_tables: SNAT target: used from hooks PREROUTING, but only usable from INPUT/POSTROUTING
    The 2nd rule worked like a treat though so thanks!

    Jim
    The reply is currently minimized Show
Your Reply