Linux iptables and network gaming

[iapetus]

Probably a hopelessly over-technical question, but maybe someone else has a similar setup. I've got a Linux firewall machine running iptables - how can I get it to forward certain port ranges on to a specified machine on the internal network - namely the port number for my PS2/XBox?

[Papercut]

I don't have that setup myself, but I have used iptables.

You need to allow the right port ranges to be forwarded from the internal network (your LAN) to the external network (the Internet) and vice versa.

To restrict to certain ports do something like:

## Insert connection-tracking modules (not needed if built into kernel).
# insmod ip_conntrack
# insmod ip_conntrack_ftp

## Create chain which blocks new connections except for certain ports.
# iptables -N block
# iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A block ! -m state --state NEW -j DROP
## outgoing on tcp port 3074 only
# iptables -A block -p tcp --destination-port 3074 -i ! ppp0 -j ACCEPT
## incoming or outgoing on udp port only
# iptables -A block -p udp --destination-port 3074 -j ACCEPT
# iptables -A block -j DROP

## Jump to that chain from INPUT and FORWARD chains.
# iptables -A INPUT -j block
# iptables -A FORWARD -j block

That probably doesn't work though, I hacked an example from Rusty's guides. As it is that would block all traffic apart from the specified ports and outgoing traffic from the firewall itself. You would at least have to open ports for other protocols you need.

Most iptables scripts allow internal machines to make any outgoing connection, if you have a script like that you just need to allow a couple of incoming ports.

There is some info on XBox Live ports here:

http://www.isaserver.org/tutorials/xboxlive.html

PS2 games each tend to use different ports.

checkout 'Rusty's Remarkably Unreliable Guides' here:

http://www.samba.org/netfilter/unreliable-guides/

particularly:

http://www.samba.org/netfilter/unreliable-guides/packet-filtering-HOWTO/index.html

and

http://www.samba.org/netfilter/unreliable-guides/NAT-HOWTO/NAT-HOWTO.linuxdoc-6.html#ss6.2