On Thu, May 05, 2005 at 05:31:54PM +0100, Greg Cope wrote:
> Hi all,
>
> I have an iptables firewall that has 3 ethernet cards,
> eth0(Red/internet) , eth1 (DMZ), eth2 (lan)
>
> eth0 has a few alias;
>
> eth0 (217.154.55.249) gateway
> eth0:1 (217.154.55.250) for the mail server - an A record for mail.e-dba.net
> eth0:2 (217.154.55.253) for a webserver
> eth0:3 (217.154.55.245) another alias for a host on the DMZ
>
> When sending trafic from this firewall host or any host behind it the
> trafic leaves from eth0 (217.154.55.249).
>
> The firewalls default gateway router is an ADLS ethernet modem on 217.154.55.241
>
> However mail (SMTP) trafic goes in via 217.154.55.250, and I would
> like it to go out via 217.154.55.250 as this has the correct
> (mail.e-dba.net) PTR records.
<--snip crazy routing stuff-->
sounds like you want 1-to-1 NAT for the mail server, which takes 2 NAT
rules (one for connections initiated *to* the mailserver, and one for
connections initiated *from* the mailserver):
iptables -t nat -A PREROUTING -i eth0 -d 217.154.55.250 \
-j DNAT --to-destination $MAILSRV_PRIV_IP
iptables -t nat -A POSTROUTING -o eth0 -s $MAILSRV_PRIV_IP \
-j SNAT --to-source 217.154.55.250
sounds like you already have the 1st rule in place. make sure the 2nd
rule comes *before* any outbound SNAT/MASQ rule that is less specific.
-j
--
"Dennis Miller: I don't want to go on a rant, here, but America's
foreign policy makes about as much sense as Beowulf having sex
with Robert Fulton at the first battle of Antietam. I mean when
a neo-conservative defenestrates it's like Raskolnikov filibuster
deoxymonohydroxinate...
Peter: What the hell does rant mean?"
--Family Guy
