On Thursday 2005-November-10 08:14, luisccmail-netfilter@xxxxxxxxxxxx
wrote:
> iptables -t nat -A PREROUTING -p tcp \
> -d box-a.local --destination-port 2200 \
> --jump DNAT --to-destination box-b.local:2222
>
> # This should re-write outgoing connections after routing,
> # so they appear to originate from the Box-A host.
> iptables -t nat -A POSTROUTING -p tcp \
> -d box-b.local --destination-port 2222 \
> --jump SNAT --to-source box-a.local
> # EOF #############################
>
> Oh, well, now begin my problem: this doesn't work, and I don't have
iptables won't resolve names in --to-(source|destination) arguments.
Hint: when the man page says "ipaddr" for an argument it means you must
use numeric dotted quad IP addresses, not gethostbyname() or DNS names.
If you want to retain control of name-to-address mapping, use a bit of
shell code in `` backticks to extract your IP address. Yours would be a
grep(1) and cut(1)[1] job. Or if you use DNS names, dig(1):
`dig +short name.fqdn`
That will return just the IP if there is a single "A" record for
"name.fqdn".
[1] /bin/cut is easy, but it invokes another process. If you're using
bash(1) there are numerous ways to slice and dice the output of your
grep(1) command all within the presently running shell. I'm a bit hazy
on the details and it's off topic here anyway. :) Use whichever is
easiest for you; just be aware that the bash way is a tiny bit better.
--
mail to this address is discarded unless "/dev/rob0"
or "not-spam" is in Subject: header
