On Thursday 15 April 2004 3:28 pm, Alexander Economou wrote:
> If i understood well , you have a linux firewall with a dmz ip and you
> want to redirect traffic from a real ip to lan ip of your network.If i am
> correct then you should do :
>
> iptables -t nat -F
> iptables -t nat -A POSTROUTING -o dmzinterface -j MASQUERADE
I disagree with this rule. It will make all connections to servers in the
DMZ network appear to come from the firewall, which will destroy any useful
logging on the services which are running.
> iptables -t nat -A PREROUTING -p tcp -d dmzip --dport 6181 -j DNAT --to
> lanip:6181
> iptables -t nat -A PREROUTING -p tcp -d dmzip --dport 6182 -j DNAT --to
> lanip:6182
> etc etc
It's important to remember that in addition to the PREROUTING rules to do the
address translation, you need FORWARDign rules to allow the now-translated
packets through the firewall. It was the FORWARDing rules which were the
problem in Nick's script.
Regards,
Antony.
--
Wanted: telepath. You know where to apply.
Please reply to the list;
please don't CC me.
