Acces to www server in LAN from WAN

[lubos]

Hi all,

i have thi configuration.
(WAN)<------>(Asus Wl-500g Deluxe)<------>(LAN) www server (PC)
in asus is loaded oleg firmware 1.9.2.7

I need to access the www server on the PC in the LAN area from the wan area.

I have tryed to set Virual server, ip_tables in post_firewall, but I'm no abble to get this working.

in post firewall I use this commands for forwarding

X.X.X.X is my WAN


iptables -t nat -A PREROUTING -p tcp -i vlan1 -d X.X.X.X --dport 30000 -j DNAT --to 192.168.1.191:30000
iptables -I FORWARD 2 -p tcp -i vlan1 -d 192.168.1.191 --dport 30000 -j ACCEPT

iptables config



Chain PREROUTING (policy ACCEPT 57 packets, 7337 bytes)
pkts bytes target prot opt in out source destination
27 1620 VSERVER all -- any any anywhere X.X.X.X
0 0 NETMAP udp -- any any anywhere X.X.X.Xudp spt:6112 192.168.1.0/24
1 60 DNAT tcp -- vlan1 any anywhere anywhere tcp dpt:ssh to:192.168.1.1:22
0 0 DNAT tcp -- vlan1 any anywhere X.X.X.Xtcp dpt:30000 to:192.168.1.191:30000

Chain POSTROUTING (policy ACCEPT 120 packets, 8461 bytes)
pkts bytes target prot opt in out source destination
0 0 NETMAP udp -- any any 192.168.1.0/24 anywhere udp dpt:6112 X.X.X.X/32
9 684 MASQUERADE all -- any vlan1 !X.X.X.X anywhere
3 180 MASQUERADE all -- any br0 192.168.1.0/24 192.168.1.0/24

Chain OUTPUT (policy ACCEPT 123 packets, 8641 bytes)
pkts bytes target prot opt in out source destination

Chain VSERVER (1 references)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- any any anywhere anywhere tcp dpt:webcache to:192.168.1.1:80


Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- any any anywhere anywhere state INVALID
4119 771K ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
110 6600 ACCEPT all -- lo any anywhere anywhere state NEW
4 759 ACCEPT all -- br0 any anywhere anywhere state NEW
16 5446 ACCEPT udp -- any any anywhere anywhere udp spt:bootps dpt:bootpc
0 0 ACCEPT tcp -- any any anywhere WL-0011D8E0A0AF tcp dpt:www
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ftp
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
26 1560 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
0 0 DROP all -- any any anywhere anywhere

Chain FORWARD (policy ACCEPT 9 packets, 684 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- br0 br0 anywhere anywhere
0 0 ACCEPT tcp -- vlan1 any anywhere 192.168.1.191 tcp dpt:30000
0 0 DROP all -- any any anywhere anywhere state INVALID
9 684 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 DROP all -- !br0 vlan1 anywhere anywhere
0 0 ACCEPT all -- any any anywhere anywhere ctstate DNAT

Chain OUTPUT (policy ACCEPT 3875 packets, 1283K bytes)
pkts bytes target prot opt in out source destination

Chain MACS (0 references)
pkts bytes target prot opt in out source destination

Chain SECURITY (0 references)
pkts bytes target prot opt in out source destination
0 0 RETURN tcp -- any any anywhere anywhere tcp flags:SYN,RST,ACK/SYN limit: avg 1/sec burst 5
0 0 RETURN tcp -- any any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/RST limit: avg 1/sec burst 5
0 0 RETURN udp -- any any anywhere anywhere limit: avg 5/sec burst 5
0 0 RETURN icmp -- any any anywhere anywhere limit: avg 5/sec burst 5
0 0 DROP all -- any any anywhere anywhere

Chain logaccept (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- any any anywhere anywhere state NEW LOG level warning tcp-sequence tcp-options ip-options prefix `ACCEPT '
0 0 ACCEPT all -- any any anywhere anywhere

Chain logdrop (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- any any anywhere anywhere state NEW LOG level warning tcp-sequence tcp-options ip-options prefix `DROP '
0 0 DROP all -- any any anywhere anywhere



Does anybody now, where can be the problem?

Thanks lubos

[zwerfkat]

You should first find out if the request X.X.X.X:30000 is blocked by the router its firewall or not. From the router its web interface, you should enable logging for blocked packets. In the syslog from the web interface (or file //tmp/syslog.log) you can see if your request was blocked or not. I suppose 192.168.1.191:30000 from the LAN is working well?