Forwarding ports to the outside world

markyd · n00b Joined: 16 Apr 2002 Posts: 44

ok I run 6 computer at home, one of which acts as an internet gateway for the rest of the machines. Setting this up is easy enough using iptables. I have also managed to get transparent proxying working.

However, what I want to do now is something a bit wierd. The gateway is running gentoo (of course) and is the only computer directly connected to the outside world. One of the computers on the internal lan is running windows xp and what I want to do is have alls request from the outside world on port 3389 (remote desktop) addressed to the gateway forwarded to the win xp box on the internal lan.

Any ideas?

darktux · Posted: Wed Jun 18, 2003 12:03 pm Post subject:

iptables -t nat -A PREROUTING -p tcp -d your.externel.ip --dport 3389 -j DNAT --to ip.of.your.windows.box

From the top of my head, this is the rule to use.
_________________
Lego my ego, and I'll lego your knowledge

www.tuxslare.org - My reborn website

markyd · n00b Joined: 16 Apr 2002 Posts: 44

Thanks that worked perfectly...

darktux · Posted: Thu Jun 19, 2003 12:49 am Post subject:

fatcat.00 · Tux's lil' helper Joined: 12 Aug 2002 Posts: 145

Yes that may work, but realize that you have essentially placed your XP box on the outside of your firewall, at least for 3389. Since this is a remote admin tool, I STRONGLY suggest you not do this.

If you can lock down the source address that will help matters, but make darn sure you have a really hard password, AND you keep wired into Microsoft for bug fixes on that service.

IMHO you are asking for trouble, but I am sure you have already weighed the benefits vs. drawbacks.
_________________
-- Fatcat

markyd · n00b Joined: 16 Apr 2002 Posts: 44

Well basically i just wrote a shell script that enables it for 30 mins then disables it. So I don't think its that insecure. Its just as secure as having ssh open on your machine.

taskara · Posted: Thu Jun 19, 2003 5:29 am Post subject: Re: Security