iptables, double nat question.

[meekrob]

Hi,

I've been using iptables for years now, but perhaps I don't really understand how NAT works.

I have an iptables firewall (firewall box) running behind an actiontec dsl router. The actiontec actually runs an embedded linux w/ iptables. Behind the firewall box is a Linux samba server that I need to access using ssh. I also access the firewall box over ssh. I use port 22 for the firewall box and forward port 222 to the samba box port 22. This set up worked great using Cox, (with a bridging router). The DSL router is set to pass everything to the firewall, using NAT (I think).

The result is that I can ssh to port 22 accessing the firewall. However, I cannot access port 222 to the samba box. If I plug in my laptop on the interface connected to the dsl router I can access 222 - showing that the firewall is forwarding 222 to the samba server.

My theory is that iptables doesn't like the fact that I am NATting twice, once on the DSL router and then on the firewall. I'm looking for someone with a better understanding of NAT to explain why, and of course a solution would be nice.

I could ssh into the firewall and then ssh into the samba box, but that isn't what I'm looking for. My rsync over ssh backups require a direct ssh connection.

Thank you for reading this convoluted story! Thanks in advance for any comments or advice.

 

[jkupski]

Could you diagram this? I'm having a hard time getting my head around your situation.

If you're talking about something like:

Client -- NAT Router -- Internet -- NAT Router -- Samba Server

there shouldn't be any problem.

 

[meekrob]

It's more like:

Client(SSH)-NAT Router-Internet-NAT Router(Actiontec GT-701b)-NAT Router(Linux iptables dedicated firewall)-Samba Server

 

[jkupski]

Question: if you are already forwarding all ports from the DSL router to the linux box, why is the linux box there?

Suggestion: if you need to keep this configuration, try a many-many NAT between the DSL router and the linux box instead of one-many.