On 2005.01.29 23:15, Alireza Yazdani - yazdani1193@xxxxxxxxx wrote:
Hello all,
I have 2 box for cache, bandwidth manager, firewall, NAT .
one box is cache server(squid) only. and another box is bandwidth manager,
firewall, NAT server.
I haven't any rule on my squid box. the default gateway of my users is my
firewall box. my firewall box has 2 ethernet(user side and internet side).
ip of firewall box is :
iptables_box_ILAN=172.16.5.5 (user side)(eth0)
iptables_box_WLAN=212.213.38.100 (internet side)(eth1)
ip of cache box is :
squid_box=172.16.5.6
the default gateway of cache box is firewall box
I use of this rule for NAT :
iptables -t nat -A POSTROUTING -s 172.16.5.0/24 -o eth1 -j SNAT --to
212.213.38.100
now I want redirect the request on port 80 to cache box :
local_network=172.16.5.0/24
iptables_box_ILAN=172.16.5.5
iptables_box_WLAN=212.213.38.100
iptables -t nat -A PREROUTING -i eth0 -s ! $squid_box -p tcp --dport 80 -j
DNAT --to $squid_box:3128
On reflection, the NAT source and destination syntax
is not quite right (you do not use --to) instead:
iptables -t nat -A PREROUTING -i eth0 -s ! $squid_box -p tcp --dport 80 -j
DNAT --to-destination $squid_box:3128
iptables -t nat -A POSTROUTING -s $local_network -d $squid_box -o eth0 -j
SNAT --to $iptables_box_ILAN
iptables -t nat -A POSTROUTING -s $local_network -d $squid_box -o eth0 -j
SNAT --to-source $iptables_box_ILAN
A SNAT rule like this allows clients on the local net to address a server
on the local net by the external ip address. The packets appear to come
from the firewall, therefore the server replies there. I do not see why
this is needed for a proxy. I think the proxy does need SNAT for itself
to reach the internet. Something like this, which you may already have:
iptables -t nat -A POSTROUTING -s $squid_box -o eth1
-j SNAT --to-source $iptables_box_WLAN
iptables -A FORWARD -s $local_network -d $squid_box -i eth0 -o eth0 -p tcp
--dport 3128 -j ACCEPT
when I don't use of NAT it is correct. and when I set all on one ethernet it
is correct.
but when I have two ethernet and I NAT on firewall box it's not work
correct.
--
Jim Laurino
nfcan.x.jimlaur@xxxxxxxx
Please reply to the list.
Only mail from the listserver reaches this address.
