sorry, foot in mouth... syntax was wrong.. iptables -I PREROUTING -t nat -s 192.168.30.0/24 -i $INTDEV -d 192.168.40.40 -j DNAT --to 192.168.30.11 iptables -I POSTROUTING -t nat -s 192.168.30.0/24 -o $INTDEV -d 192.168.30.11 -j SNAT --to 192.168.30.1 I think that's better... Thanks, ____________________________________________ George Vieira Systems Manager georgev@xxxxxxxxxxxxxxxxxxxxxx Citadel Computer Systems Pty Ltd http://www.citadelcomputer.com.au Phone : +61 2 9955 2644 HelpDesk: +61 2 9955 2698 -----Original Message----- From: George Vieira Sent: Wednesday, July 30, 2003 1:41 PM To: Carlo Florendo; netfilter@xxxxxxxxxxxxxxxxxxx Subject: RE: DNAT from an IP address that does not exist to another that exists You must iptables -I PREROUTING -t nat -s 192.168.30.0/24 -i $INTDEV -d 192.168.40.40 -j DNAT --to 192.168.40.40 iptables -I POSTROUTING -t nat -s 192.168.30.0/24 -d 192.168.40.40 -j SNAT --to 192.168.30.1 so basically your masquerading the internal users like you would if the server was outside, you replace the source IP with the masq server so the 192.168.40.40 (192.168.30.11) machine knows it MUST send it back via the gateway and NOT DIRECT to the 192.168.30.X user...
