Skip to Content

Register Login

Industry Online Support

Technical Forum

Navigation

Iptables 2050 missing

Created by: DVBHUZ at: 9/29/2020 5:00 PM (8 Replies)

Rating (0)

Thanks 1

9 Entries

9/29/2020 5:00 PM	Rate (0)
DVBHUZ Regular Member Joined: 6/26/2019 Last visit: 9/18/2023 Posts: 22 Rating: (0)	Hello, in IOT2040, with iptables, this works: iptables -t nat -A PREROUTING -p tcp --dport "port" -i eth0 -j DNAT --to-destination "ip eth1":"port" iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE In IOT2050 there isn't iptables. I tried to install iptables, nftables, fwd and firewalld. Try what i try doesn't work. Somebody knows how to make a port forwarding between eth0 and eth1 with IOT2050? "nftables is the default and recommended firewalling framework in Debian, and it replaces the old iptables(and related) tools" https://wiki.debian.org/nftables Attachment firewalld backends kernels.png (362 Downloads)

Suggestion To thank Quote Answer

9/30/2020 8:30 AM	Rate (0)
bergmanu Platinum Expert Joined: 4/28/2015 Last visit: 9/21/2023 Posts: 3256 Rating: (367)	Hi, what is the error trying to install these packages? Best regards!

Suggestion To thank Quote Answer

10/7/2020 8:34 PM	Rate (0)
DVBHUZ Regular Member Joined: 6/26/2019 Last visit: 9/18/2023 Posts: 22 Rating: (0)	Hello, Attached pdf file with screenshots of errors in: iptables nftables firewall-cmd ufw Additionally I attach another pdf with the goal I want to achieve. Attachment error iptables nftables ufw firewalld and goal.zip (284 Downloads)

Suggestion To thank Quote Answer

10/8/2020 8:22 AM	Rate (0)
bergmanu Platinum Expert Joined: 4/28/2015 Last visit: 9/21/2023 Posts: 3256 Rating: (367)	Hi, thanks for this detailed description, now I see the problem. With the image you can download (V1.0.2) we have some problems with iptables in the kernel-config. See here. The linked fix is checked in to the github sources of the image. Following these instructions you can build the current image from github. With this image you can use iptables. Best regards!

Suggestion To thank Quote Answer

10/8/2020 9:01 AM	Rate (0)
DVBHUZ Regular Member Joined: 6/26/2019 Last visit: 9/18/2023 Posts: 22 Rating: (0)	Thanks for your quick response. Just two things: 1) So it's as if I made a 1.0.25 image by myself. Right? 2) When SIEMENS plans to release a new version of the official image with these bugs fixed?

Suggestion To thank Quote Answer

10/8/2020 9:31 AM	Rate (0)
bergmanu Platinum Expert Joined: 4/28/2015 Last visit: 9/21/2023 Posts: 3256 Rating: (367)	Hi, the "selfmade" image does not have any version tag. From where did you get 1.0.25? We tag the images with a version once we have a fixed content for the next release. Since there is no fix yet, there is no new version yet. Once there is a new version you can find it in github under releases. I don't know when a new version will be released and provided as binary. There are still some open points to clarify. That's also the reason why there is no fix for the new version. Best regards!

Suggestion To thank Quote Answer

10/8/2020 5:46 PM	Rate (0)
DVBHUZ Regular Member Joined: 6/26/2019 Last visit: 9/18/2023 Posts: 22 Rating: (0)	Hello, I haven't gotten v1.0.25 from anywhere. I have only given it a more current name. I have already mounted the image. VM with OS DEBIAN. I have followed these instructions: su (enter password) apt update apt install docker.io If user is "dvb" the not root usermod -aG docker dvb usermod -aG docker $ USER Reboot VM mkdir IOT2050_Images cd IOT2050_Images git clone https://github.com/siemens/meta-iot2050.git cd meta-iot2050 ./kas-docker --isar build kas-iot2050-example.yml Final directory dvb = myuser /home/dvb/IOT2050_Images/meta-iot2050/build/tmp/deploy/images/iot2050 Thanks for link: https://support.industry.siemens.com/tf/ww/en/posts/237116 I have achivied to install both iptables and nftables. And I do not get the mistakes previous. Now I have to verify that they work properly. I would like to share the image obtained, but compressed it has a size of 650MB. Is there any possibility to post it on the forum? On the other hand, I see that the nodes have been incorporated into NODE-RED: - sqlie - mindconnect - modbus - s7 - opcua - dashboard It is a great advance not to have to install them if you need them. The NODE-RED version is v1.0.6. Do you plan to update it on the official SIEMENS image?

Suggestion To thank Quote Answer

10/9/2020 11:43 AM	Rate (0)
bergmanu Platinum Expert Joined: 4/28/2015 Last visit: 9/21/2023 Posts: 3256 Rating: (367)	Hi, unfortunately it is not possible to host your image in the forum. Yep, there are a lots of improvements since the first release Don't know it node-red is gonna be updated in the sources, but should be easy to update it on the running image. Best regards!

Suggestion To thank Quote Answer

11/18/2020 9:32 PM	Rate (0)
DVBHUZ Regular Member Joined: 6/26/2019 Last visit: 9/18/2023 Posts: 22 Rating: (0)	Hi, I can definitely confirm that in the image with v1.0.2 there is an error installing the nftables module (successor to iptables). I have already made it work with an image created from with the instructions above. Steps to route a port from an interface eth0 (192.168.200.1) to eth1 (192.168.1.101). 1) nano /etc/sysctl.conf 2) uncomment net.ipv4.ip_forward = 1 3) sysctl -p (or reboot) 4) sudo apt-get install nftables 5) systemctl enable nftables.service 6) check with "nft" command without error 7) nano /etc/nftables.conf 8) copy this text into file "#! / Usr / sbin / nft -f flush ruleset table inet filter { } table ip nat { chain prerouting { type nat hook prerouting priority 0; policy accept; iifname "eth0" tcp dport 8080 counter packets 40 bytes 2080 dnat to 192.168.1.101:80 } chain postrouting { type nat hook postrouting priority 100; policy accept; oifname "eth1" masquerade } } " 9) sudo systemctl restart nftables.service And it would be. If you want to do it by command line, the instructions are these: nft add table inet filter nft add table ip nat nft add chain nat prerouting {type nat hook prerouting priority 0 \; } nft add chain nat postrouting {type nat hook postrouting priority 100 \; } nft add rule ip nat prerouting iifname "eth0" tcp dport 8080 counter dnat to 192.168.1.101:80 nft add rule ip nat postrouting oifname "eth1" masquerade nft list ruleset> /etc/nftables.conf nano /etc/nftables.conf Put at the beginning of file: " #! / usr / sbin / nft -f flush ruleset " Best regards!

Suggestion To thank Quote Answer
This contribution was helpful to 1 thankful Users bergmanu

|

Share this page:

Share this page on...

Related topics by keywords:

SIMATIC IOT2050 Software

Follow us on