On Tue, Mar 23, 2004 at 07:44:07PM +0100, Cestonaro Thilo wrote: > Hey, > > i have a vpn established and working via a Linux (Debian) Box and a > Windows with openvpn. > The tap devices have the following ips: > linux 192.168.200.201 > windows 192.168.200.202 > > My intern network address at linux net is > 192.168.1.0/24 > and under windows it's > 192.168.0.0/24 > > now my question: > I want to forward the ports 2005 2006 7064 from the Linux net into the > Windows net ( enough when the packets appear at the vpn endpoint in > Windows net) > I get at the Linux VPN box the packets via eth0 > these packets are send to 255.255.255.255:2005 for example. I think you will find that broadcast packets can't be NAT in this fashion, there are a few app's (daemon) out there that re route these in the fashion that you want, but you need the deamon at both ends of the tunnel. > Now I want them to go into the tap0 dev and appear at the windows box. > > I tried following rules for iptable at the linux box: > > iptables -A INPUT -i tap0 -j ACCEPT > iptables -A OUTPUT -o tap0 -j ACCEPT > > iptables -t nat -A PREROUTING -p udp -i eth0 --dport 2005 -j DNAT --to > 192.168.200.202:2005 > iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 2005 -j DNAT --to > 192.168.200.202:2005 > iptables -t nat -A PREROUTING -p udp -i eth0 --dport 2006 -j DNAT --to > 192.168.200.202:2006 > iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 2006 -j DNAT --to > 192.168.200.202:2006 > iptables -t nat -A PREROUTING -p udp -i eth0 --dport 7064 -j DNAT --to > 192.168.200.202:7064 > iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 7064 -j DNAT --to > 192.168.200.202:7064 > > iptables -A FORWARD -p udp -i eth0 --dport 2005 -j ACCEPT > iptables -A FORWARD -p tcp -i eth0 --dport 2005 -j ACCEPT > iptables -A FORWARD -p udp -i eth0 --dport 2006 -j ACCEPT > iptables -A FORWARD -p tcp -i eth0 --dport 2006 -j ACCEPT > iptables -A FORWARD -p udp -i eth0 --dport 7064 -j ACCEPT > iptables -A FORWARD -p tcp -i eth0 --dport 7064 -j ACCEPT > > > Could anyone say why this is not working? > I looked at the tap0 dev for outgoing packets with "iptraf -i tap0 -u". > But there are nor outgoing neither incoming packets :( > > Ciao Thilo > > >
Attachment:
signature.asc
Description: Digital signature
