Re: How to use netfilter to do static IP mapping?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



By the way, for my case, do I also need to add this
rule:

iptables -t nat -A POSTROUTING -o eth0 -s 10.1.1.2 --j
SNAT --to 1.1.1.2
..etc..

Regards
Patrick

 --- Jason Opperisano <opie@xxxxxxxxxxx> 內容:
> On Thu, 2004-09-23 at 23:24, Patrick Dung wrote:
> > Dear All
> > 
> > This is what I want:
> > 
> > eth0 as internet (1.1.1.1)
> > eth1 as dmz (10.1.1.1)
> > 
> > dmz has a web (10.1.1.2) and dns (10.1.1.3) server
> > with private IP.
> > The netfilter fw will do the static IP (public to
> > private) IP mapping.
> > Avaliable public IP (example):
> > 1.1.1.1 (eth0), 1.1.1.2 (for web), 1.1.1.3 (for
> dns)
> > 
> > Now I have these rules:
> > 
> > iptables -t nat -A PREROUTING -i eth0 -d 1.1.1.2
> -p
> > tcp --dport 80 -j DNAT --to 10.1.1.2:80
> > iptables -t nat -A PREROUTING -i eth0 -d 1.1.1.3
> -p
> > udp --dport 53 -j DNAT --to 10.1.1.3:53
> > 
> > The problem is that there is no response from
> 1.1.1.2
> > and 1.1.1.3.
> > Do I need other special setting (proxy arp?)
> 
> yup.  on netfilter machine:
> 
>   ip address add 1.1.1.2 dev eth0
>   ip address add 1.1.1.3 dev eth0
> 
>  remember to use 10.1.1.[23] in your filter rules
> and not 1.1.1.[23].
> 
> -j
> 
> -- 
> Jason Opperisano <opie@xxxxxxxxxxx>
> 
> 
>  

_________________________________________________________
必殺技、飲歌、小星星...
浪漫鈴聲  情心連繫
http://us.rd.yahoo.com/evt=22281/*http://ringtone.yahoo.com.hk/


[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux