Matevz Langus írta:
To easy to be true. Tried this one already. I get this:
iptables v1.3.5: Can't use -i with POSTROUTING
:-D Right :-D
Okay, then try this:
iptables -t mangle -A PREROUTING -j CONNMARK -i eth0.10 -s 192.168.1.1
-d $firewal_virtual_ip_on_10 --set-mark 1
iptables -t mangle -A PREROUTING -j CONNMARK -i eth0.11 -s 192.168.1.1
-d $firewal_virtual_ip_on_11 --set-mark 2
...
iptables -t nat -A PREROUTING -j DNAT -m connmark --mark 1
--to-destination $firewal_real_ip_on_10
iptables -t nat -A PREROUTING -j DNAT -m connmark --mark 2
--to-destination $firewal_real_ip_on_11
...
iptables -t mangle -A OUTPUT -j CONNMARK -d 192.168.10.1 --set-mark 1
iptables -t mangle -A OUTPUT -j CONNMARK -d 192.168.11.1 --set-mark 2
...
iptables -t nat -A OUTPUT -j DNAT -m mark ! --mark 0 --to-destination
192.168.1.1
iptables -t mangle -A POSTROUTING -j ROUTE -m mark --mark 1 --oif eth0.10
iptables -t mangle -A POSTROUTING -j ROUTE -m mark --mark 2 --oif eth0.11
...
iptables -t nat -A POSTROUTING -j SNAT -m mark --mark 1 --to-source
$firewal_virtual_ip_on_10
iptables -t nat -A POSTROUTING -j SNAT -m mark --mark 2 --to-source
$firewal_virtual_ip_on_12
...
With this scenario the devices on the VLANs can only talk to the firewall...
Matevz
On Nov 15, 2006, at 9:13 AM, Gáspár Lajos wrote:
iptables -t nat -A POSTROUTING -j SNAT -i eth0.10 -s 192.168.1.1
--to-source 192.168.10.1
