On Wednesday 07 April 2004 6:25 pm, bdameron@xxxxxxxxxx wrote:
> > If you tell us what your rules are and give us some more detail about
> > your network setup, we might be able to help, however a better solution
> > for you is to look at some of the excellent documentation available to
> > learn how to do it yourself. This is not a hard problem, and you will be
> > able to manage your system much better in future if you understand more
> > about how it works.
> >
> > One very important detail which is not clear from your description above
> > is: where is the "client machine" located?
>
> Client machine being anyone from the outside world. And I have looked
> over some of the documentation. Basically there is no current firewall
> policies. Just want anything coming in on xxx.xxx.xxx.xxx:443 (Internet
> Machine) to be routed to 10.10.1.110:443 (Internal Lan Machine).
>
> Looks like I need to mangle the packet header so that the Lan machine thinks
> that the Internet machine is sending the packet and then have the Internet
> machine redirect the packet to the client. Client again being someone on the
> Internet. Not sure if this can be done or not. Correct me if I am wrong.
With all due respect, yes, you are very wrong. This is a simple "nat +
forward" situation.
Since you haven't said what your ruleset is, I shall assume none, and give you
an example of how to make work what you have asked for:
iptables -F
iptables -F -t nat
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 443 -d 10.10.1.110 -j ACCEPT
iptables -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 10.10.1.110
If eth0 is not your external interface then change it in the above two rules
for whatever your external interface is.
Regards,
Antony.
--
Abandon hope, all ye who enter here.
You'll feel much better about things once you do.
Please reply to the list;
please don't CC me.
