Whats wrong with my iptables?

Question

Problem

I cannot get requests to my server on port 80 to redirect to my client on port 8080

Server

I am using a CentOS 6.3 VM as the server, the client is an Arduino

Server eth0 - 172.16.145.139 eth1 - 10.14.4.1

Client eth0 - 10.14.45

End Goal

Any sort of fix that will allow me to get the webpage from my internal client

What I have Tried

I have tried to modify my iptables in various ways to allow me access. Closest I got was my client registered that a connection was made but the webpage would not load. This also occurred when I used an SSH tunnel. So I think there is some setting that I am over looking that is not allowing it to forward correctly

# cat /proc/sys/net/ipv4/ip_forward
1

IPTABLES

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 10.14.4.5:8080
-A POSTROUTING -s 10.14.4.0/25 -o eth0 -j SNAT --to-source 172.16.145.139
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -s 10.14.4.0/25 -o eth0 ! -d 10.14.4.0/25 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

Thanks in advance for any and all help!

Answer 1

Here's what works for me on my VM server (adapted to your IPs):

## Allow through firewll
iptables -I FORWARD -d 10.14.4.5/32 -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
## Set up NAT forwarding rule
iptables -t nat -I PREROUTING -p tcp -i eth0 --destination-port 8080 -j DNAT --to-destination 10.14.4.5:80

It looks like you are missing the first rule, which allows the packets to come through the firewall. The nat rule on yours looks ok though.

Note, that "-I" inserts at the top of the rule chain, "-A" appends to the bottom. In the case of the first rule, we want it to come before the "reject" rule in your filter table -- the easiest way is to go ahead and insert it at the top (if you are modifying an existing table -- otherwise, go ahead and convert it to "-A" and put it before the "reject" rule if modifying an existing config file).