On Tue, Jun 05, 2001 at 08:09:41AM -0500, David Talbot wrote: > #THIS IS THE PROBLEM LINE > iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 10.0.0.1 > #THIS IS THE PROBLEM LINE I think I know what the problem is. Before that though, Juri is right in saying that this is more easily and effectively achieved using Squid, but, that being said... You're trying to do DNAT onto the same network. You change the destination IP of the packets back onto the local network, but when they hit 10.0.0.1 they look like they came from the external IP of your router, and so they get dropped. Look at: http://netfilter.samba.org/unreliable-guides/NAT-HOWTO/NAT-HOWTO.linuxdoc-10.html Try adding: iptables -t nat -A POSTROUTING -p tcp -s <yourLAN> -d 10.0.0.1 --dport 80 -j SNAT --to <NATboxIP> It worked for me, but I had to do some other fiddling because I'm also doing policy based (source) routing, and so my setup might not quite be the same as yours, but it's worth a try. If you use tcpdump, you should see packets hitting 10.0.0.1 from a non-LAN IP. -- Adrian Chung (adrian at enfusion-group dot com) http://www.enfusion-group.com/~adrian GPG Fingerprint: C620 C8EA 86BA 79CC 384C E7BE A10C 353B 919D 1A17 [rogue.enfusion-group.com] up 28 days, 23:15, 3 users
