新聞財經娛樂♬資訊 News Economy

yes, but not stable sometimes work sometimes not work, so
talk about this in new thread

Where you able to forward the port as you wanted to?

Thanks for all of your reply

you're welcome... back

my server is stable now, so I can follow this thread again

you probably can skip "-i venet0:0 -o venet0:0" altogether without breaking stuff

if you want better help, please copy-paste the command you typed and what the system answered. if possible, also post an ifconfig and your kernel version.

But I found error at second command about -i switch

at
iptables -t nat -A POSTROUTING -p tcp -d 98.138.253.109 --dport 80 -i venet0:0 -o venet0:0 -j SNAT --to-source 212.1.213.76

Please advise
Duncan

this looks good, but what a PITA to do in netfilter

iptables -t nat -A PREROUTING  -p tcp -d 212.1.213.76 --dport 80 -j DNAT --to-destination 98.138.253.109:80
iptables -t nat -A POSTROUTING -p tcp -d 98.138.253.109 --dport 80 -i venet0:0 -o venet0:0 -j SNAT --to-source 212.1.213.76
iptables -A FORWARD -p tcp -d 98.138.253.109  --dport 80 -j ACCEPT

Yes, that does forward on my box.

Yes, I get Yahoo error as well.

Correction in protocol was nntp changed to http:

iptables -t nat -A PREROUTING  -p tcp -d 98.138.253.109 --destination-port http -j DNAT --to-destination 212.1.213.76:80iptables -t nat -A POSTROUTING -i venet0:0 -o venet0:0 -d 98.138.253.109 --dport 80 -j SNAT --to 212.1.213.76
iptables -A FORWARD -p tcp -d 98.138.253.109  --dport 80 -j ACCEPT

sytnax error --dport or -dport and -d 98.138.253.100 where -d is invalid

Did you try it on your linux computer, do you get yahoo error.html page ?

how can I set -s 212.1.213.76 with port 80 by iptables ?

iptables -A FORWARD -s 212.1.213.76 -p tcp -i venet0:0 -o venet0:0 -d 98.138.253.109 --dport 80 -j ACCEPT

that also is not working even add -s 212.1.213.76

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        
ACCEPT     tcp  --  0.0.0.0/0            98.138.253.109      tcp dpt:80
ACCEPT     tcp  --  212.1.213.76            98.138.253.109      tcp dpt:80

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        
ACCEPT     tcp  --  0.0.0.0/0            98.138.253.109      tcp dpt:80

it seems there is issue  at 0.0.0.0

I do it again the following command
iptables -A PREROUTING -t nat -i venet0:0 -p tcp --dport 80 -j DNAT --to 98.138.253.109:80
iptables -A FORWARD -p tcp -i venet0:0 -o venet0:0 -d 98.138.253.109 --dport 80 -j ACCEPT
iptables -L -n >junk.txt  

And I don't do iptables save and be reminded I also do echo "1" > /proc/sys/net/ipv4/ip_forward



Outout  from Iptables -L -n
=========================
Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
acctboth   all  --  0.0.0.0/0            0.0.0.0/0          
DROP       all  --  188.143.233.30       0.0.0.0/0          
DROP       all  --  183.60.213.5         0.0.0.0/0          

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        
ACCEPT     tcp  --  0.0.0.0/0            98.138.253.109      tcp dpt:80

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        
acctboth   all  --  0.0.0.0/0            0.0.0.0/0          

Chain acctboth (2 references)
target     prot opt source               destination        
           tcp  --  212.1.209.210        0.0.0.0/0           tcp dpt:80
           tcp  --  0.0.0.0/0            212.1.209.210       tcp spt:80
           tcp  --  212.1.209.210        0.0.0.0/0           tcp dpt:25
           tcp  --  0.0.0.0/0            212.1.209.210       tcp spt:25
           tcp  --  212.1.209.210        0.0.0.0/0           tcp dpt:110
           tcp  --  0.0.0.0/0            212.1.209.210       tcp spt:110
           icmp --  212.1.209.210        0.0.0.0/0          
           icmp --  0.0.0.0/0            212.1.209.210      
           tcp  --  212.1.209.210        0.0.0.0/0          
           tcp  --  0.0.0.0/0            212.1.209.210      
           udp  --  212.1.209.210        0.0.0.0/0          
           udp  --  0.0.0.0/0            212.1.209.210      
           all  --  212.1.209.210        0.0.0.0/0          
           all  --  0.0.0.0/0            212.1.209.210      
           tcp  --  212.1.213.76         0.0.0.0/0           tcp dpt:80
           tcp  --  0.0.0.0/0            212.1.213.76        tcp spt:80
           tcp  --  212.1.213.76         0.0.0.0/0           tcp dpt:25
           tcp  --  0.0.0.0/0            212.1.213.76        tcp spt:25
           tcp  --  212.1.213.76         0.0.0.0/0           tcp dpt:110
           tcp  --  0.0.0.0/0            212.1.213.76        tcp spt:110
           icmp --  212.1.213.76         0.0.0.0/0          
           icmp --  0.0.0.0/0            212.1.213.76        
           tcp  --  212.1.213.76         0.0.0.0/0          
           tcp  --  0.0.0.0/0            212.1.213.76        
           udp  --  212.1.213.76         0.0.0.0/0          
           udp  --  0.0.0.0/0            212.1.213.76        
           all  --  212.1.213.76         0.0.0.0/0          
           all  --  0.0.0.0/0            212.1.213.76        
           all  --  0.0.0.0/0            0.0.0.0/0

Could you please post your entire iptables config file?

Using FORWARD, it is same as before no change , i mean it still mysite.com web page

You might be forwarding already

Please use this

iptables -A PREROUTING -t nat -i venet0:0 -p tcp --dport 80 -j DNAT --to 98.138.253.109:80
iptables -A FORWARD -p tcp -i venet0:0 -o venet0:0 -d 98.138.253.109 --dport 80 -j ACCEPT

it is same as before no change , i mean it still mysite.com wbe page

Do you think that is related NTAT firewall it should be POSTROUTING or PreROUTING ?

Ok

Try it like this:

iptables -A PREROUTING -t nat -i venet0:0 -p tcp --dport 80 -j DNAT --to 98.138.253.109:80
iptables -A INPUT -p tcp -m state --state NEW --dport 80 -i venet0:0 -j ACCEPT

SOrry, I prefer to use iptables command
we can change DNS reocrd that is similar result or method that  we can do redirect on index.html page at mega tag

That is good study and praticse on iptables linux command

Ok.

To be clear:

1) You have a website hosted on IP 212.1.213.76
2) You want visitors to be forwarded to website at IP 98.138.253.109
2a) Could you please check there is a website at that IP 98.138.253.109, navigating to http://98.138.253.109 gives me an error.

I think that rather than port forwarding you might need to change the DNS record for www.yourdomain.com to the IP 98.138.253.109.

Or better still make www.yoursite.com a CNAME record for www.yahoo.com

I was successful before when play around those iptables command and I can see
the yahoo.com result on my browser when typing www.mysite.com , but now
I can NOT repeat the result. So it seems iptable is workable for my case

Just forward my website to other website by iptables command
for example, when you type www.mysite.com , it will go to yahoo.com or faceboo.com
Be remined I am not asking to do it on HTML refresh for redirect on META tag

Last time, I can do it on Cpanel for website port forwarding, but now I didn't pay for Cpanel

Dear duncanb7, what you ask for might not be what you had in mind or I didn't understand the question.

Could you please rephrase what you want to do? Ask again in other words if possible what you are trying to accomplish.

In the meantime while awaiting for your response I'll answer your first question:

Question-1:
Why it is not eth0 or eth1 device name intead of venet0 and venet0:0
What is different ?

eth0 and eth1 are just tags or names that reference a piece of hardware or an Ethernet interface. In your server they are just called with other names like venet0 and venet0:0 because (I infer from the name) it's a virtual interface as in VE (virtual environment). Your box might be running as a VM (virtual machine) of some sort and not directly on the hardware environment.

port forwarding in this context will ot work, because the remote site will not sent the return packets back.

it could work if you do source nat as well as the default destination nat when using FORWARD.

it is likely simpler to setup a reverse proxy if you want something transparent
http://httpd.apache.org/docs/2.2/mod/mod_proxy.html
proxypass / http://remote_server
should do

duncanb7,

A message has been sent to some additional experts asking them to review your question. We will check back again to see if you are getting the help you need.

This request included Experts from Apache Web Server, Linux Networking, Web Servers, Network Design & Methodology, Network Operations.

Please do not respond to this comment; we will be monitoring your question for activity from the Experts.

Thank you for using Experts Exchange,

SouthMod
Community Support Moderator
http://www.experts-exchange.com/R_22120.html

duncanb7,

I changed the zones for this question from

--Apache Web Server
--Linux Networking

to
--Apache Web Server
--Linux Networking
--Web Servers
--Network Design & Methodology
--Network Operations


SouthMod
Community Support Moderator

my purpose is same as redirect on index page  of php or html page to other site
but I want to do it by linux comand of iptables

my purpose is same as redirect on html page to other site
but I want to do it by linux comand of iptables

Port forwarding to an external site is the same as you usually do except you swap the interfaces. Instead of external interface to internal interface you reverse the flow.