Ubuntu 20.04 Server local Port redirect with ufw not working

Discussion in 'Installation/Configuration' started by swissAlisha, Apr 7, 2021.

  1. swissAlisha

    swissAlisha New Member

    Hello all,

    I have the following problem and I don't see the error or I don't know what I'm doing wrong that it doesn't work.
    I have an Ubuntu 20.04 server with two IP addresses here in the example with 192.168.1.77 and 192.168.1.78 and I want to redirect the TCP. Port 23 from IP 192.168.1.78 to port 2323 additionally because the service behind it listens primarily on 2323.
    Below in the config examples I have two different variants of /etc/ufw/before.rules in the *nat section therefore variant 1 and variant 2

    I hope someone can help me with my problem, also I don't see any smart information in /var/log/syslog nor in /var/log/ufw.log indicating a problem.

    [email protected]:~# cat /etc/netplan/00-installer-config.yaml
    # This is the network config written by 'subiquity'
    network:
    ethernets:
    enp0s3:
    addresses:
    [192.168.1.77/24, 192.168.1.78/24]
    gateway4: 192.168.1.1
    nameservers:
    addresses:
    - 192.168.1.1
    search:
    - fritz.box
    version: 2
    [email protected]:~#
    ----------------------------------------------------------------------------------
    [email protected]:~# cat /etc/sysctl.conf |grep forward
    # Uncomment the next line to enable packet forwarding for IPv4
    net.ipv4.ip_forward=1
    # Uncomment the next line to enable packet forwarding for IPv6
    #net.ipv6.conf.all.forwarding=1
    [email protected]:~#
    ----------------------------------------------------------------------------------
    Variante 1
    [email protected]:~# cat /etc/ufw/before.rules
    #
    # rules.before
    #
    # Rules that should be run before the ufw command line added rules. Custom
    # rules should be added to one of these chains:
    # ufw-before-input
    # ufw-before-output
    # ufw-before-forward
    #
    *nat
    :pREROUTING ACCEPT [0:0]
    -A PREROUTING -d 192.168.1.78 -p tcp --dport 23 -j REDIRECT --to-port 2323
    COMMIT

    # Don't delete these required lines, otherwise there will be errors
    *filter
    :ufw-before-input - [0:0]
    :ufw-before-output - [0:0]
    :ufw-before-forward - [0:0]
    :ufw-not-local - [0:0]
    # End required lines

    # allow all on loopback
    -A ufw-before-input -i lo -j ACCEPT
    -A ufw-before-output -o lo -j ACCEPT

    # quickly process packets for which we already have a connection
    -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

    # drop INVALID packets (logs these in loglevel medium and higher)
    -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
    -A ufw-before-input -m conntrack --ctstate INVALID -j DROP

    # ok icmp codes for INPUT
    -A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
    -A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
    -A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
    -A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

    # ok icmp code for FORWARD
    -A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
    -A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
    -A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
    -A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT

    # allow dhcp client to work
    -A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT

    #
    # ufw-not-local
    #
    -A ufw-before-input -j ufw-not-local

    # if LOCAL, RETURN
    -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN

    # if MULTICAST, RETURN
    -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN

    # if BROADCAST, RETURN
    -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN

    # all other non-local packets are dropped
    -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
    -A ufw-not-local -j DROP

    # allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above
    # is uncommented)
    -A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT

    # allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above
    # is uncommented)
    -A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT

    # don't delete the 'COMMIT' line or these rules won't be processed
    COMMIT
    [email protected]:~#
    ----------------------------------------------------------------------------------
    Variante 2
    [email protected]:~# cat /etc/ufw/before.rules
    #
    # rules.before
    #
    # Rules that should be run before the ufw command line added rules. Custom
    # rules should be added to one of these chains:
    # ufw-before-input
    # ufw-before-output
    # ufw-before-forward
    #
    *nat
    :pREROUTING ACCEPT [0:0]
    -A PREROUTING -d 192.168.1.78 -p tcp --dport 23 -j DNAT --to-destination 192.168.1.78:2323
    COMMIT

    # Don't delete these required lines, otherwise there will be errors
    *filter
    :ufw-before-input - [0:0]
    :ufw-before-output - [0:0]
    :ufw-before-forward - [0:0]
    :ufw-not-local - [0:0]
    # End required lines

    # allow all on loopback
    -A ufw-before-input -i lo -j ACCEPT
    -A ufw-before-output -o lo -j ACCEPT

    # quickly process packets for which we already have a connection
    -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

    # drop INVALID packets (logs these in loglevel medium and higher)
    -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
    -A ufw-before-input -m conntrack --ctstate INVALID -j DROP

    # ok icmp codes for INPUT
    -A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
    -A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
    -A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
    -A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

    # ok icmp code for FORWARD
    -A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
    -A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
    -A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
    -A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT

    # allow dhcp client to work
    -A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT

    #
    # ufw-not-local
    #
    -A ufw-before-input -j ufw-not-local

    # if LOCAL, RETURN
    -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN

    # if MULTICAST, RETURN
    -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN

    # if BROADCAST, RETURN
    -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN

    # all other non-local packets are dropped
    -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
    -A ufw-not-local -j DROP

    # allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above
    # is uncommented)
    -A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT

    # allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above
    # is uncommented)
    -A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT

    # don't delete the 'COMMIT' line or these rules won't be processed
    COMMIT
    [email protected]:~#
    ----------------------------------------------------------------------------------
    [email protected]:~# cat /etc/ufw/user.rules
    *filter
    :ufw-user-input - [0:0]
    :ufw-user-output - [0:0]
    :ufw-user-forward - [0:0]
    :ufw-before-logging-input - [0:0]
    :ufw-before-logging-output - [0:0]
    :ufw-before-logging-forward - [0:0]
    :ufw-user-logging-input - [0:0]
    :ufw-user-logging-output - [0:0]
    :ufw-user-logging-forward - [0:0]
    :ufw-after-logging-input - [0:0]
    :ufw-after-logging-output - [0:0]
    :ufw-after-logging-forward - [0:0]
    :ufw-logging-deny - [0:0]
    :ufw-logging-allow - [0:0]
    :ufw-user-limit - [0:0]
    :ufw-user-limit-accept - [0:0]
    ### RULES ###

    ### tuple ### allow tcp 22 192.168.1.77 any 0.0.0.0/0 in
    -A ufw-user-input -p tcp -d 192.168.1.77 --dport 22 -j ACCEPT

    ### tuple ### allow tcp 23 192.168.1.78 any 0.0.0.0/0 in
    -A ufw-user-input -p tcp -d 192.168.1.78 --dport 23 -j ACCEPT

    ### tuple ### allow tcp 2323 192.168.1.78 any 0.0.0.0/0 in
    -A ufw-user-input -p tcp -d 192.168.1.78 --dport 2323 -j ACCEPT

    ### END RULES ###

    ### LOGGING ###
    -A ufw-after-logging-input -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
    -I ufw-logging-deny -m conntrack --ctstate INVALID -j RETURN -m limit --limit 3/min --limit-burst 10
    -A ufw-logging-deny -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
    -A ufw-logging-allow -j LOG --log-prefix "[UFW ALLOW] " -m limit --limit 3/min --limit-burst 10
    ### END LOGGING ###

    ### RATE LIMITING ###
    -A ufw-user-limit -m limit --limit 3/minute -j LOG --log-prefix "[UFW LIMIT BLOCK] "
    -A ufw-user-limit -j REJECT
    -A ufw-user-limit-accept -j ACCEPT
    ### END RATE LIMITING ###
    COMMIT
    [email protected]:~#
    ----------------------------------------------------------------------------------
    [email protected]d4:~# cat /etc/default/ufw
    # /etc/default/ufw
    #

    # Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback
    # accepted). You will need to 'disable' and then 'enable' the firewall for
    # the changes to take affect.
    IPV6=yes

    # Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if
    # you change this you will most likely want to adjust your rules.
    DEFAULT_INPUT_POLICY="DROP"

    # Set the default output policy to ACCEPT, DROP, or REJECT. Please note that if
    # you change this you will most likely want to adjust your rules.
    DEFAULT_OUTPUT_POLICY="ACCEPT"

    # Set the default forward policy to ACCEPT, DROP or REJECT. Please note that
    # if you change this you will most likely want to adjust your rules
    DEFAULT_FORWARD_POLICY="ACCEPT"

    # Set the default application policy to ACCEPT, DROP, REJECT or SKIP. Please
    # note that setting this to ACCEPT may be a security risk. See 'man ufw' for
    # details
    DEFAULT_APPLICATION_POLICY="SKIP"

    # By default, ufw only touches its own chains. Set this to 'yes' to have ufw
    # manage the built-in chains too. Warning: setting this to 'yes' will break
    # non-ufw managed firewall rules
    MANAGE_BUILTINS=no

    #
    # IPT backend
    #
    # only enable if using iptables backend
    IPT_SYSCTL=/etc/ufw/sysctl.conf

    # Extra connection tracking modules to load. IPT_MODULES should typically be
    # empty for new installations and modules added only as needed. See
    # 'CONNECTION HELPERS' from 'man ufw-framework' for details. Complete list can
    # be found in net/netfilter/Kconfig of your kernel source. Some common modules:
    # nf_conntrack_irc, nf_nat_irc: DCC (Direct Client to Client) support
    # nf_conntrack_netbios_ns: NetBIOS (samba) client support
    # nf_conntrack_pptp, nf_nat_pptp: PPTP over stateful firewall/NAT
    # nf_conntrack_ftp, nf_nat_ftp: active FTP support
    # nf_conntrack_tftp, nf_nat_tftp: TFTP support (server side)
    # nf_conntrack_sane: sane support
    IPT_MODULES=""
    [email protected]:~#
    ----------------------------------------------------------------------------------
    [email protected]:~# netstat -na |more
    Active Internet connections (servers and established)
    Proto Recv-Q Send-Q Local Address Foreign Address State
    tcp 0 0 192.168.1.78:2323 0.0.0.0:* LISTEN
    tcp 0 0 192.168.1.78:53 0.0.0.0:* LISTEN
    tcp 0 0 192.168.1.77:53 0.0.0.0:* LISTEN
    tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN
    tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN
    tcp 0 0 192.168.1.77:22 0.0.0.0:* LISTEN
    tcp 0 0 192.168.1.77:25 0.0.0.0:* LISTEN
    tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
    tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN
    tcp 0 0 192.168.1.77:22 192.168.1.141:62064 ESTABLISHED
    tcp6 0 0 fe80::a00:27ff:fe5e::53 :::* LISTEN
    tcp6 0 0 ::1:53 :::* LISTEN
    tcp6 0 0 ::1:953 :::* LISTEN
    udp 0 0 127.0.0.1:40427 127.0.0.53:53 ESTABLISHED
    udp 0 0 192.168.1.78:53 0.0.0.0:*
    udp 0 0 192.168.1.78:53 0.0.0.0:*
    udp 0 0 192.168.1.78:53 0.0.0.0:*
    udp 0 0 192.168.1.78:53 0.0.0.0:*
    udp 0 0 192.168.1.77:53 0.0.0.0:*
    udp 0 0 192.168.1.77:53 0.0.0.0:*
    udp 0 0 192.168.1.77:53 0.0.0.0:*
    udp 0 0 192.168.1.77:53 0.0.0.0:*
    udp 0 0 127.0.0.1:53 0.0.0.0:*
    udp 0 0 127.0.0.1:53 0.0.0.0:*
    udp 0 0 127.0.0.1:53 0.0.0.0:*
    udp 0 0 127.0.0.1:53 0.0.0.0:*
    udp 0 0 127.0.0.53:53 0.0.0.0:*
    udp6 0 0 ::1:53 :::*
    udp6 0 0 ::1:53 :::*
    udp6 0 0 ::1:53 :::*
    udp6 0 0 ::1:53 :::*
    udp6 0 0 fe80::a00:27ff:fe5e::53 :::*
    udp6 0 0 fe80::a00:27ff:fe5e::53 :::*
    udp6 0 0 fe80::a00:27ff:fe5e::53 :::*
    udp6 0 0 fe80::a00:27ff:fe5e::53 :::*
    raw6 0 0 :::58 :::* 7
    Active UNIX domain sockets (servers and established)

    Thanks for helping and best regards

    Alisha Manuela
     

Share This Page