On Fri, Jan 31, 2003 at 01:14:06PM +0000, Katriel Traum wrote: > Okay, sounds good, so say I want to save me a 2000 SNAT ports (I don't think > I'll have 2000 sockets open at the same time) > here's the ruleset I should use: > > iptables -A PREROUTING -i $INET_IF -p tcp --dport ! 60000:62000 -j DNAT \ > - --to-destination $DMZ_IP > iptables -A PREROUTING -i $INET_IF -p udp --dport ! 60000:62000 -j DNAT \ > - --to-destination $DMZ_IP > > iptables -A POSTROUTING -o $INET_IF -i $LAN_IF -j SNAT --to-source \ > $INET_IP:60000-62000 Looks good at first glance here. > as for ICMP, I didn't quite understand you. can you elaborate? For TCP to operate correctly you *NEED* some ICMP working. ICMP isn't just for ping! There are things like network, host and port unreachable. There's also things like Path MTU discovery which involves an ICMP message being sent back if a packet is too big for part of the route and has the Do not Fragment (DF) flag set. Basically not allowing ICMP in a blind fashion is NOT the way to do things. You probably just need to make sure you have the proper FORWARD rules (filter chain, it's the default so no -t) to allow both ESTABLISHED and RELATED. You can find these in any mention of SNAT in docs/howtos. HTH, -Ath -- - Athanasius = Athanasius(at)miggy.org / http://www.miggy.org/ Finger athan(at)fysh.org for PGP key "And it's me who is my enemy. Me who beats me up. Me who makes the monsters. Me who strips my confidence." Paula Cole - ME
Attachment:
pgp00295.pgp
Description: PGP signature
