A little iptables help

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]




Aleksandar Milivojevic wrote:
> You assumed right.  However, Netfilter is smart enough to change source 
> address
> on returning packet without explicit SNAT rule(s).  As long as incomming 
> and
> outgoing packets are going through same firewall 

Ah ha! I *was* right. :) If you have more than one router on the network, you need to 
make sure the internal host uses the same router doing the DNAT for it's outbound 
traffic.

On our network we have more than one router doing SNAT for the internal network which 
provides redundancy and load sharing. When I setup the inbound DNAT for SSH, I 
realized that both inbound and outbound streams from the target host had to go 
through the same router. What I didn't know is that you don't *need* the SNAT. My 
network just *happens* to be doing it.

Thanks,
Kirk


[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]
  Powered by Linux