Nightmare with virtual server

[Khurram]

What do you call "internal machines"? Servers on the router or servers on the LAN?

If servers on the router then WPTE hint is enough. If servers on the LAN then you need to use the FORWARD chain.

From internal machines, I mean machines on my LAN.

why not to use VSERVER chain? it's used for new connections from wan side.

That is how the router itself is doing it. For port forwarding to the router itself, the firmware adds a rule to the VSERVER chain and another rule to the INPUT chain. For forwarding to internal machines, you would probably need a rule to VSERVER and another to FORWARD chain.

I have not tested it out yet. I plan to do this today and post back the results here.

[Khurram]

I tried it on the router and it works great Thanks for all the help.

To summarize, if you are port forwarding on the router itself:

1) iptables -t nat -A VSERVER -p tcp --dport <router external port> -j DNAT --to-destination <router internal ip>:<router internal port>
2) iptables -D INPUT -j DROP
3) iptables -A INPUT -p tcp --dport <router internal port> -j ACCEPT
4) iptables -A INPUT -j DROP

If you are forwarding to another pc on the lan:

1) iptables -t nat -A VSERVER -p tcp --dport <router external port> -j DNAT --to-destination <internal pc ip>:<internal pc port>
2) iptables -A FORWARD -p tcp --dport <router external port> -j ACCEPT

You can restrict the scope of the VSERVER rules to the external interface but I have not done that for now. I have all my VSERVERs set up in post-firewall and it is working great.

[theMIROn]

If you are forwarding to another pc on the lan:
...
2) iptables -A FORWARD -p tcp --dport <router external port> -j ACCEPT

looks redundant, there's already (if firewall wan->lan is tuned from web-ui):

-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT

You can restrict the scope of the VSERVER rules to the external interface but I have not done that for now.

same for that. it's automagicaly restricted to the external interfaces.

[Khurram]

looks redundant, there's already (if firewall wan->lan is tuned from web-ui):

-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT

same for that. it's automagicaly restricted to the external interfaces.

Thanks for the info