Bruce Ferrell írta:
I am trying to establish an ipsec tunnel from a system that is also a
snat router. so far I seem to be able to have my masquerade or my vpn
tunnel but not both.
the basic rules I'm using are these:
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state
ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
These are VERY BASIC rules...
Any suggestions?
You can use the MARK/CONNMARK target ot mark the vpn/nat packets.
With that information you will be able to do the NATing or leting
through the vpn...
Swifty
