I have a problem which I thought I'd seen the solution so somewhere, but I just can't find the posting anymore.
I have an iptables firewall, and I port forward to an internal email server on a 192.168.10.0/24 LAN network.
This all works fine, external email comes & goes OK. My problem is that I want to allow internal network users to address the email server using the external IP address of the firewall.
Currently, laptop users internal to the network need to then become external when they work external to the LAN, and they have to either setup 2 different email accounts (one using the internal email server IP address, and one using the external IP address), or they have to remember to change their server settings each time they move from internal to external and vice-versa. Both of these are a pain for them.
I have attempted to allow this to work by using the following prerouting rules & forward rules (default policies are DROP, DROP, ACCEPT)
iptables -t nat -A PREROUTING -p tcp --dport 25 -j DNAT --to 192.168.10.12:25
iptables -t nat -A PREROUTING -p tcp --dport 110 -d -j DNAT --to 192.168.10.12:110
iptables -t nat -A PREROUTING -p tcp --dport 143 -d -j DNAT --to 192.168.10.12:143
iptables -A FORWARD -p tcp -s 0/0 -d 192.168.10.12/32 --destination-port 25 --syn -j ACCEPT
iptables -A FORWARD -p tcp -s 0/0 -d 192.168.10.12/32 --destination-port 110 --syn -j ACCEPT
iptables -A FORWARD -p tcp -s 0/0 -d 192.168.10.12/32 --destination-port 143 --syn -j ACCEPT
These are just more generalised rules that people commonly use for doing port forwarding - I have just made them less strict by taking about the input & output constraints in an attempt to allow external & internal clients to access the email server via the external ip.
It doesn't work, the email client just times out, as if I'm still blocking some part of the data stream.
What am I doing wrong ?
thanks. -Tim
