[Solved] About port redirection

Installing and Using OpenWrt Network and Wireless Configuration
1

I would like to redirect a port which works like this.
"packets with XXXX TCP port received by WAN, will redirect to a internal NAT's gateway address(in my case, it is 192.168.1.1) with XXXX TCP port."

so, i made this script.

iptables -t nat -A INPUT -p tcp -dport XXXX -j DNAT -to 192.168.1.1:XXXX

I think this script will never work. Since DNAT should be used with prerouting, not INPUT.
Even if i change INPUT to prerouting, i think this won't work.

I really can't think more scripts. Can i get some help?

2

You should be able to do this with standard port forwarding rules. Is there a reason you'd rather write the rule directly in iptables?

I'm not sure why you obscured your ports... but the rule would look like this:

config redirect
	option target 'DNAT'
	option name 'PortRedirect'
	list proto 'tcp'
	option src 'wan'
	option src_dport '<incoming port>'
	option dest 'lan'
	option dest_ip '192.168.1.1'
	option dest_port '<redirected/listening port>'
3 Likes
3

I've added that rule at firewall.config, and restarted firewall.
whenever i check via iptables -S, i cannot see it's applied.
Obviously, i cannot send a packet from WAN to LAN's gateway.

i also tried rebooting and still it's not working.

reason i obscured port is, port might change. that's all.
I'm currently using this to handle IoT devices.

4

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik

cat /etc/config/firewall
1 Like
5

and i forgot this.
reason i'm trying to use iptables is because in case of user changes the gateway's IP, putting 192.168.1.1 won't work.

If i am right, i guess it's better to use iptables command and add that script at firewall.user file.

and here is what you asked for.

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config redirect
        option name 'mqtt1833'
        option target 'DNAT'
        option name 'PortRedirect'
        list proto 'tcp'
        option src 'wan'
        option src_dport '1883'
        option dest 'lan'
        option dest_ip '192.168.1.1'
        option dest_port '1883'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config include 'pptpd'
        option type 'script'
        option path '/etc/pptpd.include'
        option reload '1'

config rule 'pptp'
        option name 'pptp'
        option target 'ACCEPT'
        option src 'wan'
        option proto 'tcp'
        option dest_port '1723'

config rule 'gre'
        option name 'gre'
        option target 'ACCEPT'
        option src 'wan'
        option proto '47'

config redirect
        option name 'mqtt1833'
        option target 'DNAT'
        option name 'PortRedirect'
        list proto 'tcp'
        option src 'wan'
        option src_dport '1883'
        option dest 'lan'
        option dest_ip '192.168.1.1'
        option dest_port '1883'

is the part that you told to me.

6

You’re not changing the port here, so you can remove this and use a simple traffic rule instead. Accept port 1883 from src wan.

1 Like
7

i see

config rule
        option name            'mqtt1883'
        option src             'wan'
        option src_dport       '1883'
        option proto           'tcp'
        option target          'ACCEPT'

As this, right?

8

Yes. That is correct. Be sure to remove any other rules with that port

1 Like
9

Works Great!
However, i would like to add a function that i can enable this or disable this.
So i just used iptables -I when i want to enable, and iptables -D when i want to disable at my existing codes made with lua scripts.

Thanks for the help.

10

awesome!

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.

1 Like
11

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.