Here is my example below: -
############################################################################### # # Destination NAT on the same network # ###############################################################################
$IPTABLES -A FORWARD -i eth1 -o eth1 -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -d 192.168.2.254 -s 192.168.2.0/24 -p tcp --dport 22 -j SNAT --to 192.168.2.1
$IPTABLES -t nat -I PREROUTING -d 200.200.200.200 -p tcp --dport 22 -j DNAT --to 192.168.2.254
Regards, ro0ot
Bryan Martin wrote:
Setup looks like this
Internet ^ Redhat 9 iptables nat/masq (200.200.200.200 public address = eth1; 192.168.2.1 private address = eth0) ^ windows web server (192.168.2.254) | windows clients. (all 192.168.2.X)
Now the rh box is masquerading for the private boxes. Only thing not standard is that any inbound http connections to the public address 200.200.200.200 is being dnatted to 192.168.2.254 which is the address of the windows server. This is working as expected. The problem arises when a internal client tries to connect to the public website.
For instance client request www.mycompany.com and DNS says go here 200.200.200.200 which would be correct if I was sitting on the outside looking in. I need iptables to basically say if any http request comes from the internal network addressed to my public address dnat the public 200.200.200.200 to the private address. I have tried the following without success. Only other thing I know is to setup a internal DNS just so the internal clients get the internal address. That would however be an extreme waste of resources.
-A PREROUTING -i eth1 -d 200.200.200.200 -p tcp --dport 80 -j DNAT --to-destination 192.168.2.254
Can someone help?
Bryan
