On Wed, 08 Sep 2004 22:26:44 -0400 Jason Opperisano <opie@xxxxxxxxxxx> wrote: > On Wed, 2004-09-08 at 22:10, Tom Fischer wrote: > > Hi, > > > > i have a problem with DNAT. We have to move some services for a few > > days on another machine. So we want do DNAT on incoming Packets. I > > set > > > > iptables -A PREROUTING -t nat -s 0/0 -d xxx.xxx.xxx.xxx -p tcp > > --dport 9000-j DNAT --to xxx.xxx.xxx.xxx > > since you didn't provide your rules, i'm gonna haveta ask a really > stupid question... > > did you execute that command with the old DNAT rule in place? if > so--the new rule got appended to the end of the PREROUTING chain of > the nat table, after the old rule; therefore, will never get matched. > > it would be helpful for us list-types to see the output of: > > iptables -t nat -vnL This is the only rule. [root@server4 root]# iptables -t nat -vnL Chain PREROUTING (policy ACCEPT 645K packets, 35M bytes) pkts bytes target prot opt in out source destination 2 120 DNAT tcp -- * * 0.0.0.0/0 oldmachine tcp dpt:9000 to:newmachine Chain POSTROUTING (policy ACCEPT 62473 packets, 3966K bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 62441 packets, 3964K bytes) pkts bytes target prot opt in out source destination > > another thought--NAT happens first (PREROUTING), then filter rules. > you will need to edit your filter rule to allow traffic to > "newserver's" actual IP instead of "oldserver's" actual IP. > There are no Filterrules installed at the moment. Tom
