Port forwarding not working with iptables

I use a CentOS 7 as a gateway server. It has two network interfaces, ens28 and ens29.

The ens28 uses a private 192.168.x.x network, it is considered as the WAN. Ens29 is the LAN area with a 172.16.0.0 subnet.

I configured a NAT configuration via iptables, so the hosts on the 172... subnet can reach the internet.

Now I want a host on the subnet 172 to broadcast its webserver on port 443.

My basic configuration before the port forwarding:

# Generated by iptables-save v1.4.21 on Mon Nov 30 21:45:11 2020
*nat
:PREROUTING ACCEPT [65:4705]
:INPUT ACCEPT [1:60]
:OUTPUT ACCEPT [1:72]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o ens28 -j MASQUERADE
COMMIT
# Completed on Mon Nov 30 21:45:11 2020
# Generated by iptables-save v1.4.21 on Mon Nov 30 21:45:11 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [24:4585]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i ens28 -o ens29 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ens29 -o ens28 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

As for the forwarding, I tried with these rules:

iptables -A PREROUTING -t nat -i ens28 -p tcp --dport 443 -j DNAT --to 172.16.0.202:443
iptables -A FORWARD -p tcp -d 172.16.0.202 --dport 443 -j ACCEPT

My iptables configuration after adding the new rules:

# Generated by iptables-save v1.4.21 on Tue Dec 1 15:39:36 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [434:52068]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i ens28 -o ens29 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ens29 -o ens28 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -d 172.16.0.202/32 -p tcp -m tcp --dport 443 -j ACCEPT
COMMIT
# Completed on Tue Dec 1 15:39:36 2020
# Generated by iptables-save v1.4.21 on Tue Dec 1 15:39:36 2020
*nat
:PREROUTING ACCEPT [297:55943]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [7:532]
:POSTROUTING ACCEPT [7:532]
-A PREROUTING -i ens28 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.16.0.202:443
-A POSTROUTING -o ens28 -j MASQUERADE
COMMIT
# Completed on Tue Dec 1 15:39:36 2020

1. The webserver host's IP address is the 172.16.0.202
2. The ens28 card's address is 192.168.1.254
3. The ens29 card's address is 172.16.0.253

Port 443 is forwarded on the external router (192.168.1.0 > public IP) and is visible from the internet.

Forwarding is enabled in sysctl:

net.ipv4.ip_forward = 1

So, what I'm missing? Why is the forwarding from the 172...'s not working?

Thanks in advance.

1 Answer

Rules are checked one by one.
Each rule after the reject will be ignored.

You should invert

-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -d 172.16.0.202/32 -p tcp -m tcp --dport 443 -j ACCEPT

to

-A FORWARD -d 172.16.0.202/32 -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited