On Sun, Dec 18, 2005 at 032:42:43M -0500, Leonardo Rodrigues Magalhes wrote: > Adam, have you tried adding a properly PREROUTING rule for this > specific traffic ? It would be like > iptables -t nat -A PREROUTING -p udp -d EXTERNAL_IP_OF_NAT_BOT --dport > 500 -j DNAT --to LOCAL_CLIENT I have tried that--same result. In fact, I've tried creating a "tunnel" between the internal and external client by leaving out the port limitation, i.e.: iptables -t nat -A PREROUTING -s SERVER_IP -j DNAT --to LOCAL_CLIENT None of these have any effect because the packets never reach the nat PREROUTING chain. If I put a LOG rule at the start of nat PREROUTING, I don't see the inbound packets from the server on the Internet. (I do see those packets in the mangle PREROUTING though). > Other test I would suggest ....... have you tried some other UDP > traffic, just like DNS and see if it works ? Have you tried some TCP > traffic and see if it works fine ? Everything else seems to work fine. I have another internal box to which certain ssh connections from the Internet go, and that's fine. I'm not sure exactly how I'd test other UDP traffic... Certainly UDP traffic that is FORWARDed through the NAT box (e.g., RealPlayer streams) seems fine. -- Adam Rosi-Kessel http://adam.rosi-kessel.org
Attachment:
signature.asc
Description: Digital signature
