Re: Port forwarding via iptables to postgres listening locally
| От | David Resnick |
|---|---|
| Тема | Re: Port forwarding via iptables to postgres listening locally |
| Дата | |
| Msg-id | BANLkTi=sWzD5ffkLc_xwRR=SMcwOXqZZVg@mail.gmail.com обсуждение исходный текст |
| Ответ на | Re: Port forwarding via iptables to postgres listening locally (Craig Ringer <craig@postnewspapers.com.au>) |
| Ответы |
Re: Port forwarding via iptables to postgres listening
locally
|
| Список | pgsql-general |
Thanks a lot for your reply!
OK, the source and destination parameters were not intended to hide anything. Setting them like that got the same results in the iptables status output as when not specifying --source and --destination at all. Does --source need to be set to the address the machine is listening at? As you can guess, this is basically my first stab at configuring iptables :).
I now have the following rule in iptables:
Chain PREROUTING (policy ACCEPT 242 packets, 27431 bytes)
pkts bytes target prot opt in out source destination
0 0 REDIRECT tcp -- * * 192.23.25.177 127.0.0.1 tcp dpt:5432
Running tcpdump with "tcpdump -i any tcp port 5432" while attempting to connect remotely has this output:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
07:00:53.673349 IP 192.23.197.91.36349 > 192.23.25.177.postgresql: S 2589386703:2589386703(0) win 2360 <mss 1360,nop,nop,sackOK,nop,wscale 6,opt-112:040203030001d50ad1fe110a66fe110a,eol>
07:00:56.673042 IP 192.23.197.91.36349 > 192.23.25.177.postgresql: S 2589386703:2589386703(0) win 2360 <mss 1360,nop,nop,sackOK,nop,wscale 6,opt-112:040203030001d50ad1fe110a66fe110a,eol>
07:01:02.672689 IP 192.23.197.91.36349 > 192.23.25.177.postgresql: S 2589386703:2589386703(0) win 5840 <mss 1400,sackOK,timestamp 1081653372 0,nop,wscale 6>
07:01:14.672182 IP 192.23.197.91.36349 > 192.23.25.177.postgresql: S 2589386703:2589386703(0) win 5840 <mss 1400,sackOK,timestamp 1081665372 0,nop,wscale 6>
07:01:38.671236 IP 192.23.197.91.36349 > 192.23.25.177.postgresql: S 2589386703:2589386703(0) win 5840 <mss 1400,sackOK,timestamp 1081689372 0,nop,wscale 6>
I've turned on connection logging in postgres; there is no indication of any connection attempt. There don't seem to be any additional rules configured in iptables that would drop the packets.
Is there anything I'm missing here? Do you have any additional suggestions for something I could check?
- David
OK, the source and destination parameters were not intended to hide anything. Setting them like that got the same results in the iptables status output as when not specifying --source and --destination at all. Does --source need to be set to the address the machine is listening at? As you can guess, this is basically my first stab at configuring iptables :).
I now have the following rule in iptables:
Chain PREROUTING (policy ACCEPT 242 packets, 27431 bytes)
pkts bytes target prot opt in out source destination
0 0 REDIRECT tcp -- * * 192.23.25.177 127.0.0.1 tcp dpt:5432
Running tcpdump with "tcpdump -i any tcp port 5432" while attempting to connect remotely has this output:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
07:00:53.673349 IP 192.23.197.91.36349 > 192.23.25.177.postgresql: S 2589386703:2589386703(0) win 2360 <mss 1360,nop,nop,sackOK,nop,wscale 6,opt-112:040203030001d50ad1fe110a66fe110a,eol>
07:00:56.673042 IP 192.23.197.91.36349 > 192.23.25.177.postgresql: S 2589386703:2589386703(0) win 2360 <mss 1360,nop,nop,sackOK,nop,wscale 6,opt-112:040203030001d50ad1fe110a66fe110a,eol>
07:01:02.672689 IP 192.23.197.91.36349 > 192.23.25.177.postgresql: S 2589386703:2589386703(0) win 5840 <mss 1400,sackOK,timestamp 1081653372 0,nop,wscale 6>
07:01:14.672182 IP 192.23.197.91.36349 > 192.23.25.177.postgresql: S 2589386703:2589386703(0) win 5840 <mss 1400,sackOK,timestamp 1081665372 0,nop,wscale 6>
07:01:38.671236 IP 192.23.197.91.36349 > 192.23.25.177.postgresql: S 2589386703:2589386703(0) win 5840 <mss 1400,sackOK,timestamp 1081689372 0,nop,wscale 6>
I've turned on connection logging in postgres; there is no indication of any connection attempt. There don't seem to be any additional rules configured in iptables that would drop the packets.
Is there anything I'm missing here? Do you have any additional suggestions for something I could check?
- David
On Sun, Jun 19, 2011 at 12:21 PM, Craig Ringer <craig@postnewspapers.com.au> wrote:
On 06/19/2011 12:07 PM, David Resnick wrote:The arguments "0/0" to source and destination make absolutely no sense. I assume you're trying to hide the real values? If not, there's your problem.Hi,
I have a posgres instance configured to listen at the localhost default.
I'm trying to enable port forwarding via iptables. I set up the
following rule:
iptables -t nat -I PREROUTING --source 0/0 --destination 0/0 -p tcp
--dport 5432 -j REDIRECT
and can see that it is redirecting packets received at port 5432. But I
am unable to establish a remote connection to the postgres instance.
If your real rule has real IPs and ports, then you have other rules getting in the way. If iptables is correctly configured you should be getting a working connection. Most likely you have a port-based or IP-based OUTPUT or FORWARD rule that's dropping reply packets.
Use wireshark on the postgresql server to see whether it receives the transformed packets and if so whether it tries to reply to them. See what address and port is in the reply. Enable connection logging in postgresql and see if it logs any connection attempts.
--
Craig Ringer
В списке pgsql-general по дате отправления:
Следующее
От: Craig RingerДата:
Сообщение: Re: Port forwarding via iptables to postgres listening locally