- [Instructor] Let's try to connect to the web server
on the Ubuntu host in the DMZ
from the Windows host through the Ubuntu-Router host,
we'll be using the IP address
of the external network interface
of the Ubuntu-Router host to get to the web server.
Let's go to the Windows host and open a web browser,
type the external IP of the Ubuntu-Router host,
which is 10.0.0.6.
Press Enter.
You're unable to connect
since port-forwarding is not yet enabled,
that's why you're getting this error message.
Let's now go back to our Ubuntu-Router host
and change the firewall rules
to enable port-forwarding.
Let's edit our firewall script.
Type cd Documents, press Enter,
type ls.
Do you see our file script, myfw.sh?
Let's edit the script,
type nano myfw.sh,
press Enter.
These are the firewall rules we used
to set up our Ubuntu-Router host initially.
Let's add a couple of more rules
to enable port-forwarding.
Type iptables -t nat -A PREROUTING -p,
standing for protocol,
tcp -i -eth0 -d.
- d stands for destination and the destination is 10.0.0.6
- -dport 80,
dport here stands for destination port,
- j DNAT --to 10.0.1.5.
Since the line is too long
we have this dollar sign hiding the rest of the line.
What this rule does is changing the destination IP
of an incoming packet to 10.0.1.5.
If the packet is coming through the external interface
which is eth0 of our Ubuntu-Router host
and if its destination port is 80,
the command -t nat to 10.0.1.5
is changing the destination IP
of the packet from 10.0.0.6 to 10.0.1.5.
The next rule is iptables
- A FORWARD -p tcp -i eth0 -o eth1
- -dport 80 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT.
This line means that we allow forwarding the packets
from the input interface which is eth0,
to the output interface which is eth1.
If the package destination port is 80,
and if the packet contains a new connection request
or is part of an existing connection.
Now let's go ahead and save the script
by pressing Control and X.
Type Y, press Enter.
Run the script by typing sudo myfw.sh,
press Enter.