Quoting Antony Stone <Antony@xxxxxxxxxxxxxxxxxxxx>: > On Wednesday 07 April 2004 6:25 pm, bdameron@xxxxxxxxxx wrote: > > > > If you tell us what your rules are and give us some more detail about > > > your network setup, we might be able to help, however a better solution > > > for you is to look at some of the excellent documentation available to > > > learn how to do it yourself. This is not a hard problem, and you will > be > > > able to manage your system much better in future if you understand more > > > about how it works. > > > > > > One very important detail which is not clear from your description above > > > is: where is the "client machine" located? > > > > Client machine being anyone from the outside world. And I have looked > > over some of the documentation. Basically there is no current firewall > > policies. Just want anything coming in on xxx.xxx.xxx.xxx:443 (Internet > > Machine) to be routed to 10.10.1.110:443 (Internal Lan Machine). > > > > Looks like I need to mangle the packet header so that the Lan machine > thinks > > that the Internet machine is sending the packet and then have the Internet > > machine redirect the packet to the client. Client again being someone on > the > > Internet. Not sure if this can be done or not. Correct me if I am wrong. > > With all due respect, yes, you are very wrong. This is a simple "nat + > forward" situation. > > Since you haven't said what your ruleset is, I shall assume none, and give > you > an example of how to make work what you have asked for: > > iptables -F > iptables -F -t nat > iptables -P INPUT DROP > iptables -P OUTPUT DROP > iptables -P FORWARD DROP > iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT > iptables -A FORWARD -i eth0 -p tcp --dport 443 -d 10.10.1.110 -j ACCEPT > iptables -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 10.10.1.110 > > If eth0 is not your external interface then change it in the above two rules > > for whatever your external interface is. > > Regards, > > Antony. > I found an easier way to do this. xinetd can do port redirect. Worked perfectly. Thanks for your help. -- Thank you, Brad Dameron
