Without the SNAT rule, the redirection is not complete. E.g. dig says it expected an answer from x.x.x.x instead of 10.0.0.10.
Here is the help output for iptables… look at Commands -> --delete
root@HERMES:~$ iptables -h
iptables v1.8.7
Usage: iptables -[ACD] chain rule-specification [options]
iptables -I chain [rulenum] rule-specification [options]
iptables -R chain rulenum rule-specification [options]
iptables -D chain rulenum [options]
iptables -[LS] [chain [rulenum]] [options]
iptables -[FZ] [chain] [options]
iptables -[NX] chain
iptables -E old-chain-name new-chain-name
iptables -P chain target [options]
iptables -h (print this help information)
Commands:
Either long or short options are allowed.
--append -A chain Append to chain
--check -C chain Check for the existence of a rule
--delete -D chain Delete matching rule from chain
--delete -D chain rulenum
Delete rule rulenum (1 = first) from chain
--insert -I chain [rulenum]
Insert in chain as rulenum (default 1=first)
--replace -R chain rulenum
Replace rule rulenum (1 = first) in chain
--list -L [chain [rulenum]]
List the rules in a chain or all chains
--list-rules -S [chain [rulenum]]
Print the rules in a chain or all chains
--flush -F [chain] Delete all rules in chain or all chains
--zero -Z [chain [rulenum]]
Zero counters in chain or all chains
--new -N chain Create a new user-defined chain
--delete-chain
-X [chain] Delete a user-defined chain
--policy -P chain target
Change policy on chain to target
--rename-chain
-E old-chain new-chain
Change chain name, (moving any references)
Options:
--ipv4 -4 Nothing (line is ignored by ip6tables-restore)
--ipv6 -6 Error (line is ignored by iptables-restore)
[!] --protocol -p proto protocol: by number or name, eg. `tcp'
[!] --source -s address[/mask][...]
source specification
[!] --destination -d address[/mask][...]
destination specification
[!] --in-interface -i input name[+]
network interface name ([+] for wildcard)
--jump -j target
target for rule (may load target extension)
--goto -g chain
jump to chain with no return
--match -m match
extended match (may load extension)
--numeric -n numeric output of addresses and ports
[!] --out-interface -o output name[+]
network interface name ([+] for wildcard)
--table -t table table to manipulate (default: `filter')
--verbose -v verbose mode
--wait -w [seconds] maximum wait to acquire xtables lock before give up
--wait-interval -W [usecs] wait time to try to acquire xtables lock
default is 1 second
--line-numbers print line numbers when listing
--exact -x expand numbers (display exact values)
[!] --fragment -f match second or further fragments only
--modprobe=<command> try to insert modules using this command
--set-counters PKTS BYTES set the counter during insert/append
[!] --version -V print package version.This rule is not for DNS redirection per say, but seems to be required for your specific network setup (LAN, subnet, etc.)
As an example, to delete this rule, is the following syntax correct?
iptables -t mangle -I PREROUTING -p tcp --dport 853 ! -s 10.0.0.10 -d 8.8.8.8 -j DROP
iptables -t mangle -I PREROUTING -p tcp --dport 853 ! -s 10.0.0.10 -d 8.8.4.4 -j DROPAbsolutely, you can use -j REJECT --reject-with icmp-admin-prohibited
~# iptables -t mangle -I PREROUTING -p tcp -m multiport --dports 443,8
53 ! -s 10.0.0.10 -d 8.8.8.8 -j REJECT --reject-with icmp-admin-prohibited
iptables: Invalid argument. Run `dmesg' for more information.
x_tables: ip_tables: REJECT target: only valid in filter table, not mangleYes, mangle is limited compared to filter…
www.digitalocean.com
I'd this is the file then just scp the file and edit in notepad++ and copy it back instead of messing around in the cli.
I don't see the file, but you would just have to replace -t mangle by -t filter or just remove -t mangle as without -t information, the default table is filter.
# Generated by iptables-save v1.8.7 on Sun Jan 23 20:51:32 2022
*mangle
:PREROUTING ACCEPT [41:49134]
:INPUT ACCEPT [39:49020]
:FORWARD ACCEPT [2:114]
:OUTPUT ACCEPT [21:1544]
:POSTROUTING ACCEPT [22:1474]
COMMIT
# Completed on Sun Jan 23 20:51:32 2022
# Generated by iptables-save v1.8.7 on Sun Jan 23 20:51:32 2022
*security
:INPUT ACCEPT [24:32068]
:FORWARD ACCEPT [2:114]
:OUTPUT ACCEPT [20:1360]
COMMIT
# Completed on Sun Jan 23 20:51:32 2022
# Generated by iptables-save v1.8.7 on Sun Jan 23 20:51:32 2022
*raw
:PREROUTING ACCEPT [41:49134]
:OUTPUT ACCEPT [21:1544]
:FORWARD - [0:0]
COMMIT
# Completed on Sun Jan 23 20:51:32 2022
# Generated by iptables-save v1.8.7 on Sun Jan 23 20:51:32 2022
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:PERMIT-FWD - [0:0]
:PERMIT-IN - [0:0]
:PERMIT-OUT - [0:0]
-A INPUT -j PERMIT-IN
-A FORWARD -j PERMIT-FWD
-A OUTPUT -j PERMIT-OUT
-A PERMIT-FWD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PERMIT-FWD -m conntrack --ctstate NEW -j ACCEPT
-A PERMIT-FWD -j DROP
-A PERMIT-IN -i lo -j ACCEPT
-A PERMIT-IN -i br0 -j ACCEPT
-A PERMIT-IN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PERMIT-IN -j DROP
-A PERMIT-OUT -o lo -j ACCEPT
-A PERMIT-OUT -o br0 -j ACCEPT
-A PERMIT-OUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PERMIT-OUT -m conntrack --ctstate NEW -j ACCEPT
-A PERMIT-OUT -j DROP
COMMIT
# Completed on Sun Jan 23 20:51:32 2022
# Generated by iptables-save v1.8.7 on Sun Jan 23 20:51:32 2022
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o bo0 -j MASQUERADE
COMMIT
# Completed on Sun Jan 23 20:51:32 2022There is no security table by default in R7800 iptables. But yes, there is a specific order in which tables and chains are read, and it is important to have that in mind when building rules (particularly more complex ones).
Not necessarily more complex but more granular. The more specific the rule the tighter the match criteria and if you want to block or process something that's higher priority then move it to the top and when there's a hit it just moves to the next packet.
Amen to that!
iptables -t mangle -I PREROUTING -p tcp -m multiport --dports 443,853 ! -s 10.0.0.10 -d 8.8.8.8 -j REJECT
iptables -t mangle -I PREROUTING -p tcp -m multiport --dports 443,853 ! -s 10.0.0.10 -d 8.8.4.4 -j REJECT
iptables -t nat -I PREROUTING -p udp --dport 53 -d 111.111.111.111 -j DNAT --to 10.0.0.10:1053
iptables -t nat -I PREROUTING -p tcp --dport 53 ! -s 10.0.0.10 ! -d 10.0.0.10 -j DNAT --to 10.0.0.10
iptables -t nat -I PREROUTING -p udp --dport 53 ! -s 10.0.0.10 ! -d 10.0.0.10 -j DNAT --to 10.0.0.10
iptables -t nat -I POSTROUTING -d 10.0.0.10 -j SNAT --to 10.0.0.1Here is what I suggest:
iptables -I INPUT -p tcp -m multiport --dports 443,853 ! -s 10.0.0.10 -d 8.8.8.8 -j REJECT --reject-with icmp-admin-prohibited
iptables -I INPUT -p tcp -m multiport --dports 443,853 ! -s 10.0.0.10 -d 8.8.4.4 -j REJECT --reject-with icmp-admin-prohibited
iptables -t nat -I PREROUTING -p udp --dport 53 -d 111.111.111.111 -j DNAT --to 10.0.0.10:1053
iptables -t nat -I PREROUTING -p tcp --dport 53 ! -s 10.0.0.10 ! -d 10.0.0.10 -j DNAT --to 10.0.0.10
iptables -t nat -I PREROUTING -p udp --dport 53 ! -s 10.0.0.10 ! -d 10.0.0.10 -j DNAT --to 10.0.0.10
iptables -t nat -I POSTROUTING -d 10.0.0.10 -j SNAT --to 10.0.0.1
| Thread starter | Title | Forum | Replies | Date |
|---|---|---|---|---|
| D | Entware Voxel FW reverse proxy help | NETGEAR AC Wireless (Wi-Fi 5) | 2 | |
|
help with iptables / routing | NETGEAR AC Wireless (Wi-Fi 5) | 5 |
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!
