On Thursday 20 March 2003 07:40 pm, Dan Cox wrote: > With iptables how would I redirect all connection attempts coming from > the Internet interface to a machine inside my DMZ? I also have a LAN > that I have "masqueraded" though I don't know if thats related. My set > up is below: > > Internet IP/iface = eth0 1.2.3.4 > LAN IP/iface = eth1 192.168.0.1 > DMZ IP/iface = eth2 192.168.1.1 iptables -t nat -A PREROUTING -m state --state NEW -d 1.2.3.4 -p DNAT --to 192.168.1.x The NEW match will send new connection attempts to the DNAT IP. Anything already ESTABLISHED or RELATED will go where it is supposed to, IE replies to connections from the LAN will go back the the machine they were SNATted from, continued inbound traffic that is part of a DNATted connection to the DMZ will continue to go to the DNATted IP in the DMZ. Make sure your SNAT or MASQUERADE for traffic from the LAN is applied ONLY to traffic from the LAN by matching "-i eth1" in that rule. j > Any help is very much appreciated. Thanks > > Dan Cox
