That worked :) .2 can now connect to .1 and the Internet. Just what I wanted, thanks. The rules in effect now are (if anyone would like to know): Chain INPUT (policy ACCEPT 340K packets, 61M bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy DROP 557 packets, 46760 bytes) pkts bytes target prot opt in out source destination 567 47151 ACCEPT all -- any any 192.168.2.0/24 anywhere 96 30109 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED Chain OUTPUT (policy ACCEPT 322K packets, 44M bytes) pkts bytes target prot opt in out source destination Chain PREROUTING (policy ACCEPT 21299 packets, 2019K bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 40608 packets, 2980K bytes) pkts bytes target prot opt in out source destination 57 3700 SNAT all -- any any 192.168.2.0/24 anywhere to:192.168.1.254 Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination On Wed, Feb 25, 2004 at 01:40:47PM -0500, John A. Sullivan III wrote: > Ah! Blinded by my own assumptions! I also always have rules to allow > RELATED and ESTABLISHED traffic. As others on the list have pointed > out, it looks like you have no rule here to allow return traffic. > Assuming you are using connection tracking, you will want a rule in your > forward chain similar to: > -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT > <snip>
