0

I am really confuse about how to redirect.

I have 2 WLANs, one use to connect to the router(wln0) and one the I use as AP(wlan1).

My aim is to redirect traffic from one client connected to the AP that connecting to remote mqtt server to my local mqtt server.

I have tried those rules :

sudo iptables -t nat -A PREROUTING -p tcp -d 192.168.4.7 --dport 49154 -j DNAT --to 192.168.0.10:8883

sudo iptables -A FORWARD -p tcp -d 192.168.4.7 --dport 49154 -j ACCEPT

but it dosen't work, what I am doing wrong?

Update

More information about my setup:

wlan0 - connected to the internet ,

wlan1 - used as a AP,

client - connected to wlan1 =>internet => mqtt server (IBMcloud)

my goal is to redirect the traffic from the cloud to my local (192.168.0.10:8883) mqtt server

pi@raspberrypi:~ $ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether dc:a6:32:29:ba:5f brd ff:ff:ff:ff:ff:ff
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether dc:a6:32:29:ba:60 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.10/24 brd 192.168.0.255 scope global dynamic noprefixroute wlan0
       valid_lft 3019sec preferred_lft 2569sec
    inet6 fe80::f656:1efc:bea8:463a/64 scope link
       valid_lft forever preferred_lft forever
4: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0f:11:76:07:b5 brd ff:ff:ff:ff:ff:ff
    inet 192.168.4.1/24 brd 192.168.4.255 scope global noprefixroute wlan1
       valid_lft forever preferred_lft forever
    inet6 fe80::bfbd:af2d:73eb:931a/64 scope link
       valid_lft forever preferred_lft forever



pi@raspberrypi:~ $ ip route
default via 192.168.0.1 dev wlan0 proto dhcp src 192.168.0.10 metric 303
192.168.0.0/24 dev wlan0 proto dhcp scope link src 192.168.0.10 metric 303
192.168.4.0/24 dev wlan1 proto dhcp scope link src 192.168.4.1 metric 304

pi@raspberrypi:~ $ sudo iptables --list --verbose
Chain INPUT (policy ACCEPT 1470K packets, 291M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 1482K packets, 1051M bytes)
 pkts bytes target     prot opt in     out     source               destination
 1606  101K ACCEPT     tcp  --  any    any     anywhere             MAS8710BNC353.wlan   state NEW,ESTABLISHED

Chain OUTPUT (policy ACCEPT 177K packets, 116M bytes)
 pkts bytes target     prot opt in     out     source               destination
pi@raspberrypi:~ $ sudo iptables --table nat --list --verbose
Chain PREROUTING (policy ACCEPT 30024 packets, 2951K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 23499 packets, 2242K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 2323 packets, 174K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  any    eth0    anywhere             anywhere
13213 1270K MASQUERADE  all  --  any    wlan0   anywhere             anywhere
    0     0 MASQUERADE  all  --  any    wlan0   anywhere             anywhere
    0     0            tcp  --  any    wlan1   MAS8710BNC353.wlan   192.168.0.10         tcp spts:0:60000 dpt:8883

Chain OUTPUT (policy ACCEPT 9466 packets, 760K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  any    any     anywhere             anywhere             tcp dpt:8883 to:192.168.0.10:1883
Improve this question
11
  • I do not understand your setup. What mqtt server is connected to what wlan? What client on which wlan will connect to what mqtt server? Can you please add the output of this commands to your question: ip addr, ip route, sudo iptables --list --verbose and sudo iptables --table nat --list --verbose.
    – Ingo
    Jul 13, 2020 at 10:34
  • Thanks I updated the original post
    – Elior
    Jul 13, 2020 at 17:51
  • You want that a client on the access point can connect to the mqtt server (IBMcloud). And you want that a client on the IBMcloud can connect to your own local mqtt server. Isn't it? If so then you usually need a public ip address on your internet router and use port forwarding on the internet router so that the client on the IBMcloud can get into your protected local network. Have you setup this?
    – Ingo
    Jul 14, 2020 at 9:24
  • no, usually the clinet (my Air-conditioner ) connected to the MQTT cloud , my target is to forward the traffic to my mqtt server so I will have local control on my AC.
    – Elior
    Jul 14, 2020 at 22:59
  • Why can't you just address the air-conditioner to direct connect to the local mqtt server instead of the remote mqtt server in the IBMcloud?
    – Ingo
    Jul 15, 2020 at 8:20

2 Answers 2

Reset to default
2

The FORWARD rule is passing packages to the destination, but the packages returning to the source is probably dropped. You should post the complete listing of the rules to make a more precise answer.

So the rule:

sudo iptables -A FORWARD -p tcp -d 192.168.4.7 --dport 49154 -j ACCEPT

Should have these as well

-m state --state NEW,ESTABLISHED

So the complete rule is:

sudo iptables -A FORWARD -p tcp -d 192.168.4.7 --dport 49154 -m state --state NEW,ESTABLISHED -j ACCEPT
Improve this answer
2
  • Hi :) , thanks , can you please explain more about this addition : -m state --state NEW,ESTABLISHED
    – Elior
    Jul 13, 2020 at 9:53
  • I still can see on wire-shark the communication between the client to the remote server
    – Elior
    Jul 13, 2020 at 10:20
1

You only need one iptables rule. To have a clean starting point please completely flush your iptables with:

rpi ~$ sudo -Es
rpi ~# iptables --policy INPUT ACCEPT
rpi ~# iptables --policy FORWARD ACCEPT
rpi ~# iptables --policy OUTPUT ACCEPT
rpi ~# iptables --table nat --flush
rpi ~# iptables --table mangle --flush
rpi ~# iptables --table raw --flush
rpi ~# iptables --flush
rpi ~# iptables --delete-chain
rpi ~# exit
rpi ~$

Then we need the port where the remote mqtt server (IBMcloud) is listening. I can't find it in your question. For this example I will use the port 12345. This is the destination port that any client, connected to access point, will use to connect to the mqtt server. Now use this rule:

rpi ~$ sudo iptables -t nat -A PREROUTING -p tcp --dport 12345 -j DNAT --to-destination 192.168.0.10:8883

This should work if your local mqtt server is also running on the RasPi. If it is running on another local server then it should be needed to have a masquerading (but haven't tested it):

rpi ~$ sudo iptables -t nat -A POSTROUTING -j MASQUERADE

We have a Destination Net Address Translation (DNAT). That means only the destination ip address of the ip package is changed. So your local mqtt server sees inbound ip packages coming from 192.168.4.7 to 192.168.0.10:8883. So it will response to 192.168.4.7. This is not a problem on a local network in particular if the mqtt server is running on the RasPi, which is also the router and knows where to send the responses. I have tested it with ssh (don't have a mqtt server) and haven't needed a POSTROUTING rule.


References:

Improve this answer
4
  • what about the return traffic from my local server to client , I need to POSTROUTING rule ,no?
    – Elior
    Jul 23, 2020 at 13:39
  • @Elior I have updated the answer with the last paragraph.
    – Ingo
    Jul 23, 2020 at 16:56
  • @lngo , now the client faill in the ssl handshake ( I am using root CA on my mqtt server), how can I know in which step its fail?
    – Elior
    Jul 24, 2020 at 2:24
  • @Elior By default ssl is used to authenticate a server ("is it the right server I want to connect to?") with a certificate on the client. This is working on the OSI session layer (layer 5). I cannot see how this has something to do with ip address redirection working on the OSI network layer (layer 3). You have to manage the ssl certificates on the client so you use the correct certificate to authenticate the local mqtt server.
    – Ingo
    Jul 24, 2020 at 10:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.