Solved Help with portforwarding and IPTables

[muffintastic]

Hello,

I wonder if someone could guide I would like to forward the following ports with IPTables so am able to receive inbound/outbound connections via SoulSeek. rather not use the GUI method to enable port forwarding since it's suggested to be security risk and I want to lockdown my router as much as I can.

ports wanting to forward:

51355 - TCP
51356 - TCP

internal lan ip:

192.168.50.2

 

[ColinTaylor]

rather not use the GUI method to enable port forwarding since it's suggested to be security risk and I want to lockdown my router as much as I can.

There is no difference between using the GUI to create the forwarding rules or you writing them into the script. They're exactly the same rules. Any security risks are the same. Perhaps you're thinking of UPnP.

 

[muffintastic]

There is no difference between using the GUI to create the forwarding rules or you writing them into the script. They're exactly the same rules. Any security risks are the same. Perhaps you're thinking of UPnP.

I managed to figure it out with some Googling.

UPNP is off.
Port Forwarding is off.

Now my security assessment of the router is all in green.

Ports are both open the application when I run it.

 

[ColinTaylor]

If you're not using UPnP and you're not using Port Forwarding can you share your solution for the benefit of others?

 

[muffintastic]

If you're not using UPnP and you're not using Port Forwarding can you share your solution for the benefit of others?

Not sure if it's "correct" but it works.

iptables -t nat -A PREROUTING -p tcp --dport 51355 -j DNAT --to-destination 192.168.50.2
iptables -t nat -A PREROUTING -p tcp --dport 51356 -j DNAT --to-destination 192.168.50.2

When I run the programme on my machine and do a port forward test comes back as both open.

 

[ColinTaylor]

So this is the same as if you had used the GUI. If you look at System Log - Port Forwarding you should see your rules there.

I'm assuming that the "security assessment" you're referring to is from AiProtection. So by not using the GUI you have tricked it into not noticing the forwarding rule. So this isn't any more secure than if you had used the GUI.

 

[muffintastic]

So this is exactly the same as if you had used the GUI. If you look at System Log - Port Forwarding you should see your rules there.

I'm assuming that the "security assessment" you're referring to is from AiProtection. So by not using the GUI you have tricked it into not noticing the forwarding rule. So this isn't any more secure than if you had used the GUI.

Well, I have full control over what I want open. I know uTorrent doesn't work with my setup as the port I've used for that is blocked.

Personal preference.
Thanks for the feedback.

 

[dave14305]

How are you preventing this rule from affecting any LAN-to-WAN traffic that wants to reach ports 51355-51356 on the internet? Might be low probability, but I don’t see where you limit the rule to inbound traffic only.

 

[muffintastic]

How are you preventing this rule from affecting any LAN-to-WAN traffic that wants to reach ports 51335-51336 on the internet? Might be low probability, but I don’t see where you limit the ruto inbound traffic only.

‍
Just did some Googling used that format and according to canyouseeme both ports are open externally. When I close the programme down both ports are both closed.

I assume it works with how I've setup, all I know upnp is disabled, port triggering disabled and port forwarding.

Unless I've done something wrong?

 

[dave14305]

I assume it works with how I've setup, all I know upnp is disabled, port triggering disabled and port forwarding.

It works for your intended purpose, but you haven’t considered the unintended consequences of following a random internet guide over the router’s GUI.

If you ever want to reach those same ports of another SoulSeek destination on the interweb, it’s going to redirect it to your internal host instead.

 

[muffintastic]

It works for your intended purpose, but you haven’t considered the unintended consequences of following a random internet guide over the router’s GUI.

If you ever want to reach those same ports of another SoulSeek destination on the interweb, it’s going to redirect it to your internal host instead.

@dave14305 What would be the correct code then?

 

[dave14305]

@dave14305 What would be the correct code then?

The best approach is not to reinvent the wheel, but if you’re going to persist in doing your own thing, I would at least add -i eth0 in your rules, assuming eth0 is your WAN interface.

 

[RMerlin]

Just use the webui. You don't need to enable UPnP to configure static port forwards.

 

[muffintastic]

I just followed a linux guide here: https://www.gotothings.com/linux/port-forwarding-using-iptables.htm -- The ports I want open are open and close when the programme shuts.