On Thursday 2005-October-27 08:07, Jon Heese wrote:
> > Change your DNAT rule to match all the packets you want to match:
> >
> > iptables -vt nat -A PREROUTING -d 65.9.134.4 -p tcp --dport 6969 \
> > -j DNAT --to 192.168.0.100
>
> Except for the --verbose, that's exactly what I'm already doing to
> DNAT everything from the outside through to castor's 6969. This rule
> does not seem to be catching traffic from the inside. Do I have to
> do something special to get internal traffic into the PREROUTING
After I sent this (and went to bed :) ) I realised what must be
happening: it's getting the original packet there, but replies are
going direct to the IP of the originator.
Suppose 192.168.0.129 connects to 65.9.134.4:6969 ... the router passes
it faithfully on to 192.168.0.100. Now 192.168.0.100 has a packet from
192.168.0.129, and it won't send the reply to 65.9.134.4. The client at
192.168.0.129 is going to be confused. This cannot be a reply to my
65.9.134.4:6969 connection attempt, go away, Castor.
Perhaps you need a SNAT rule in POSTROUTING:
iptables -vt nat -A PREROUTING -p tcp --dport 6969 -s 192.168.0.0/24 \
-d 192.168.0.100 -j SNAT --to 65.9.134.4
A cleaner solution (not sure if applicable to BitTorrent) would be an
alternate DNS view, so that external clients resolve the name to
65.9.134.4 whilst internal ones resolve to 192.168.0.100.
--
mail to this address is discarded unless "/dev/rob0"
or "not-spam" is in Subject: header
