On Thursday 2005-November-10 08:14, luisccmail-netfilter@xxxxxxxxxxxx wrote: > iptables -t nat -A PREROUTING -p tcp \ > -d box-a.local --destination-port 2200 \ > --jump DNAT --to-destination box-b.local:2222 > > # This should re-write outgoing connections after routing, > # so they appear to originate from the Box-A host. > iptables -t nat -A POSTROUTING -p tcp \ > -d box-b.local --destination-port 2222 \ > --jump SNAT --to-source box-a.local > # EOF ############################# > > Oh, well, now begin my problem: this doesn't work, and I don't have iptables won't resolve names in --to-(source|destination) arguments. Hint: when the man page says "ipaddr" for an argument it means you must use numeric dotted quad IP addresses, not gethostbyname() or DNS names. If you want to retain control of name-to-address mapping, use a bit of shell code in `` backticks to extract your IP address. Yours would be a grep(1) and cut(1)[1] job. Or if you use DNS names, dig(1): `dig +short name.fqdn` That will return just the IP if there is a single "A" record for "name.fqdn". [1] /bin/cut is easy, but it invokes another process. If you're using bash(1) there are numerous ways to slice and dice the output of your grep(1) command all within the presently running shell. I'm a bit hazy on the details and it's off topic here anyway. :) Use whichever is easiest for you; just be aware that the bash way is a tiny bit better. -- mail to this address is discarded unless "/dev/rob0" or "not-spam" is in Subject: header