Hi all. I'm trying to setup a firewall/port forwarder but can't get things going. Some facts: LAN is my internal network and WAN is external. I have a static ip# on WAN and LAN. Access to SSH on firewall works. IP Forwarding and NAT from LAN to WAN works :-) The problem: On my LAN i have another machine with web, mail, ftp-server(192.168.0.100) witch have to be accessible from the WAN. But I just cant get it working. Question: At http://iptables-tutorial.frozentux.net/iptables-tutorial.html#DNATTARGET (Oskar Andreasson) says Quote "This last rule will seriously harm your logging, so it is really advisable not to use this method, but the whole example is still a valid one for all of those who can't afford to set up a specific DMZ or alike. What will happen is this, packet comes from the Internet, gets SNAT'ed and DNAT'ed, and finally hits the HTTP server (for example). The HTTP server now only sees the request as if it was coming from the firewall, and hence logs all requests from the internet as if they came from the firewall." End quote. Is there some way to do this so the logging sees the "right" IP# ??? Regards Gunnar Frödin (Sweden) One more thing: I'm trying all this out with WMware(www.vmware.com/), Virtual Machine Software, but I havent read anything about some limitations with that. # DNAT/SNAT Port Forwarding # this is the prerouting dnat iptables -A PREROUTING -t nat -p tcp -d 217.215.x.x --dport 25 -j DNAT --to-destination 192.168.0.100:25 # This allows packets from external->internal iptables -A FORWARD -p tcp -i eth0 -o eth1 -d 192.168.0.100 --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT # This allows packets from internal->external iptables -A FORWARD -p tcp -i eth1 -o eth0 -s 192.168.0.100 --sport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT # This enables access to the 'public' server from the internal network iptables -A POSTROUTING -t nat -p tcp -d 192.168.0.100 -s 192.168.0.0/24 --dport 25 -j SNAT --to-source 192.168.0.100:25
