Iptables scriptben szeretném az 5959 portot forwardolni a 192.168.2.12-es ipre. Valamiért ez nem jött össze. Mi lehet a gond?

# IPTABLE binaris

IPTABLES="/sbin/iptables"

# Kartyak

WAN="eth0"

LAN="eth1"

VPN="tun0"

echo 1 > /proc/sys/net/ipv4/ip_forward

# Minden bejovo csomag eldobasa

$IPTABLES -P INPUT DROP

$IPTABLES -P OUTPUT ACCEPT

$IPTABLES -P FORWARD ACCEPT

$IPTABLES -F

$IPTABLES -t nat -F PREROUTING

$IPTABLES -t nat -F POSTROUTING

$IPTABLES -t mangle -F PREROUTING

# Es logolasa

$IPTABLES -N LOGDROP

$IPTABLES -A LOGDROP -j LOG

$IPTABLES -A LOGDROP -j DROP

# Forwarding engedelyezese

echo 1 > /proc/sys/net/ipv4/ip_forward

# NAT

$IPTABLES -t nat -I POSTROUTING -o $WAN -j MASQUERADE

#$IPTABLES -t nat -A POSTROUTING -o $VPN -j MASQUERADE

$IPTABLES -t nat -I POSTROUTING -s 192.168.3.0/24 -o $LAN -j MASQUERADE

$IPTABLES -t nat -I POSTROUTING -s 192.168.2.0/24 -o $VPN -j MASQUERADE

# Minden nyitva localon

$IPTABLES -I INPUT -i $LAN -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -I FORWARD -i $LAN -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Kompromisszumok kulson :)

$IPTABLES -I INPUT -i $WAN -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -I FORWARD -i $WAN -m state --state ESTABLISHED,RELATED -j ACCEPT

# Port forwarding

$IPTABLES -t nat -I PREROUTING -i $LAN -p tcp --dport 5959 -j DNAT --to-destina$

$IPTABLES -I FORWARD -d 192.168.2.12 -p tcp --dport 5959 -j ACCEPT

# Uj es ervenytelen csomagok eldobasa

$IPTABLES -A FORWARD -i $WAN -m state --state NEW,INVALID -j DROP

# Port nyitasa a WAN if-re

#$IPTABLES -A INPUT -i $WAN -p tcp --dport 80 -j ACCEPT

$IPTABLES -I INPUT -i $WAN -p tcp --dport 5959 -j ACCEPT

$IPTABLES -I INPUT -i $WAN -p tcp --dport 2299 -j ACCEPT

$IPTABLES -I INPUT -i $WAN -p udp --dport 2599 -j ACCEPT

# Helyi gepen minden engedelyezve

$IPTABLES -A INPUT -i lo -j ACCEPT

# Es VPN-en is

$IPTABLES -A INPUT -i $VPN -j ACCEPT

# log those packets and inform the sender that the packet was rejected

$IPTABLES -N Rejectwall

$IPTABLES -A Rejectwall -m limit --limit 10/minute -j LOG --log-prefix "Rejectw$

$IPTABLES -A Rejectwall -j REJECT

# use the following instead if you want to simulate that the host is not reacha$

# for fun though

#$IPTABLES -A Rejectwall -j REJECT --reject-with icmp-host-unreachable

$IPTABLES -A INPUT -p icmp -j ACCEPT

# Accept related and established connections

$IPTABLES -I INPUT -i $WAN -m state --state RELATED,ESTABLISHED -j ACCEPT

$IPTABLES -I FORWARD -i $WAN -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A INPUT -p udp --sport 137 --dport 137 -j DROP

# Finally, anything which was not allowed yet

# is going to go through our Rejectwall rule

$IPTABLES -A INPUT -j Rejectwall