On Fri, Nov 05, 2004 at 09:11:24PM +0530, Vijay Kumar wrote:
> Hello,
>
> I have a firewall with three nic ( external ip, DMZ ip, LAN ip )
> I have added a subinterface on the external interface ( public ip with a public ip address )
>
> There is 1 machine on the internal LAN and I want it to go out using the IP of the sub interface,
> i.e access the internet using the exteral sub interface IP which I have added.
>
> I have done the following :
>
> iptables -t nat -I POSTROUTING -s 172.16.0.119 -o eth1:0 -j SNAT --to-source <external_ip>
i really wish this question would come up more often...
add your secondary IP address to eth1 like so:
ip addr add <external_ip> dev eth1
and write your NAT rule like so:
iptables -t nat -I POSTROUTING -s 172.16.0.119 -o eth1 \
-j SNAT --to-source <external_ip>
> After adding this I also added the below mentioned rules :
>
> iptables -A INPUT -s 172.16.0.119 -d 0.0.0.0/0.0.0.0 -j ACCEPT
INPUT is only for packets who's destination IP is local to the firewall
itself--so this will allow you to access the firewall machine from
172.16.0.119.
> iptables -I FORWARD -s 172.16.0.119 -j ACCEPT
ok. make sure you've also enabled IP forwarding:
sysctl -w net.ipv4.ip_forward=1
and make sure you're allowing reply packets back through your FORWARD
chain:
iptables -I FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
<snip>
if only there were a way to search the archives of this mailing list to
see how people have solved this riddle of the sphinx in the past...oh
wait...
http://marc.theaimsgroup.com/?l=netfilter&r=1&w=2
-j
--
"Lisa, if the Bible has taught us nothing else, and it hasn't, it's
that girls should stick to girls sports, such as hot oil wrestling
and foxy boxing and such and such."
--The Simpsons
