Lucky, : Well, there comes something to my mind: All of the 192.168.2.0/24 gets : masq'ed to the internet on the router. I think I somehow have to exclude : 192.168.2.206 (the pr.iv.at.ip) from the masq'ing, right? : Or is the best solution to put the to-be-NATed server in another subnet : (192.168.4.0/24) for example? Perhaps you could insert a new rule with ipchains or iptables. So, you have something in your chains rules that looks like this: ipchains -A forward -s 192.168.2.0/24 -d 0/0 -j MASQ Simply insert a special case: ipchains -I forward 1 -s 192.168.2.206 -d 0/0 -j ACCEPT Then the packet will not be masqueraded and will be handled by whatever other packet mangling rules you have (in particular, it will be NAT'd by the rule policy database). To verify that the RPDB has the rules you inserted, try this (your output should look similar to this; filled in with the correct pu.bl.ic.ip, of course): # ip rule show 0: from all lookup local 32765: from 192.168.2.206 lookup main map-to pu.bl.ic.ip 32766: from all lookup main 32767: from all lookup 253 # ip route show table all | grep nat nat pu.bl.ic.ip via 192.168.2.206 table local scope host Rules in both iptables and ipchains are handled sequentially, so you want to create the more specific chains rules first and then the more general. This prevents the general rule from matching before the specific rule is used. Freundliche grüsse, -Martin -- Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
