On Wed, 2013-01-02 at 15:54 -0800, Alan Evans wrote: > This is really related to iptables, not I presume Fedora-specific. But > I'm really hoping that somebody here will be able to school me on > iptables, so I don't have to find and subscribe to some other list > just to ask one question. > > > I'm faced with the problem of needing to punch a hole in a firewall on > our portal server so that, in our case, ssh to port 20022 on external > interface of that server actually just connects to port 22 on another > machine located in the network on the internal interface. I hope I'm > being clear. > > > I've tried many iterations of iptables rules to accomplish this. The > closest I've come is: > > iptables -A PREROUTING -t nat -p tcp -s 0/0 --dport 20022 -j DNAT --to > 192.168.0.35:22 > > > And indeed connecting to port 20022 on portal just goes straight to > port 22 on the other (192.168.0.35) machine. The problem is, as soon > as I apply this rule, DNS queries (portal is also a DNS server) to the > external interface stop working. > > > I've googled endlessly and found about a thousand variations by people > that are each supposed to solve a subtly different variation on what > I'm trying to do. Nothing I've tried does what I want without bad side > effects like I describe above. > > > -Alan > Hi Alan, try this ppp0=Internet connection eth0=local area network connection This will forward port 22 on the Internet to machine 192.168.0.2 port 22 on local network. iptables -A FORWARD -p tcp -i ppp0 -o eth0 -d 192.168.0.2 --dport 22 -j ACCEPT iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 22 -j DNAT --to-destination 192.168.0.2:22 Gary. -- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
