On Fri, Apr 29, 2005 at 07:13:37PM +0500, varun_saa@xxxxxxxx wrote: > >> # Generated by iptables-save v1.2.9 on Tue Apr 26 14:50:01 2005 > >> *nat > >> :OUTPUT ACCEPT [0:0] > >> :PREROUTING ACCEPT [0:0] > >> :POSTROUTING ACCEPT [0:0] > >> -A POSTROUTING -o eth0 -j MASQUERADE > > so you MASQ all outbound traffic > > Well should I or not. that's the only question you have from my post? > I have a static IP and my subnets are > > 192.168.0.0/24 > > 192.168.21.0/24 > > Is it possible to reflect them in my masq rule ? my only point was that since you don't actually do any *_filtering_* in your filter rules, and allow all traffic to be MASQ'd to a public IP, that there would be nothing stopping a client from doing whatever they wanted to do--which was your original question. if you actually *_filter_* traffic in the filter chains, there's nothing wrong with having an outbound SNAT/MASQ rule that matches all traffic, as only packets that pass through the filters will ever make it that far. i would suggest you go read: http://iptables-tutorial.frozentux.net/iptables-tutorial.html seven times. -j -- "Salesman: Well, we found out what the problem with your vacuum cleaner was: Apparently there was a meatball lodged inside. Peter: Did you save the meatball? Salesman: Ummm, no...? Peter: You bastard." --Family Guy
