I've got a rather bizarre configuration: Linux box has 4 ethernet devices (eth0, eth1, eth2, and eth3). eth2 and eth3 are looking to Internet, eth0 is LAN. I've configured SNAT so that it should give Internet access to the 192.168.91.0/24 network. Outgoing packets are translated right, and the external server sends a reply. However, the reply packet seems to be killed by iptables or otherwise ignored by the box (wireshark shows it, but the packet isn't going anywhere else). Having said that, I should notice that SNAT for tcp port 4000 works fine (this one is for an outgoing connection from the box to 192.168.91.254. I know this string should be modified but this is not the main trouble for now). IP forwarding is turned on, and iptables look like this: # Generated by iptables-save v1.3.7 on Thu Aug 16 14:10:37 2007 *nat :PREROUTING ACCEPT [70:7232] :POSTROUTING ACCEPT [1:73] :OUTPUT ACCEPT [1:73] -A POSTROUTING -p ip -s 192.168.92.0/255.255.255.0 -d ! 192.168.92.0/24 -j SNAT --to-source <REALIP> -A POSTROUTING -p ip -s 192.168.91.0/255.255.255.0 -d ! 192.168.91.0/24 -j LOG --log-prefix "SNAT " -A POSTROUTING -p ip -s 192.168.91.0/255.255.255.0 -d ! 192.168.91.0/24 -j SNAT --to-source <REALIP> -A POSTROUTING -p tcp -s ! 192.168.91.0/24 -d 192.168.91.0/24 --dport 4000 -j SNAT --to-source 192.168.91.223 -A PREROUTING -d <REALIP> -p tcp -m tcp --dport 4000 -j DNAT --to-destination 192.168.91.254 -A OUTPUT -d <REALIP> -p tcp -m tcp --dport 4000 -j DNAT --to-destination 192.168.91.254:4000 COMMIT # Completed on Thu Aug 16 14:10:37 2007 # Generated by iptables-save v1.3.7 on Thu Aug 16 14:10:37 2007 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [7063:2716993] :FWFORWARD - [0:0] :FWINPUT - [0:0] :INPUTDMZ - [0:0] :INPUTINET - [0:0] :INPUTETH2 - [0:0] :INPUTETH3 - [0:0] :INPUTLAN - [0:0] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -j FWINPUT -A FORWARD -j FWFORWARD -A OUTPUT -j ACCEPT -A FWFORWARD -p tcp -d 192.168.91.254 --dport 4000 -j ACCEPT -A FWFORWARD -i eth2 -j DROP -A FWFORWARD -i eth3 -j DROP -A FWFORWARD -p ip -d 192.168.92.0/255.255.255.0 -j DROP -A FWFORWARD -p ip -d 192.168.91.0/255.255.255.0 -j DROP -A FWFORWARD -j ACCEPT -A FWINPUT -i lo -j ACCEPT -A FWINPUT -p icmp -j ACCEPT -A FWINPUT -i eth0 -j INPUTLAN -A FWINPUT -i eth1 -j INPUTDMZ -A FWINPUT -i eth2 -j INPUTINET -A FWINPUT -i eth3 -j INPUTINET -A FWINPUT -j DROP -A INPUTDMZ -p ip -s ! 192.168.92.0/255.255.255.0 -j DROP -A INPUTDMZ -p ip -d 192.168.91.0/24 -j DROP -A INPUTDMZ -j ACCEPT -A INPUTINET -d 192.168.91.0/24 -j ACCEPT -A INPUTINET -d <REALIP> -j INPUTETH2 -A INPUTINET -d <REALIP> -j INPUTETH3 -A INPUTINET -j DROP -A INPUTETH2 -p tcp -m tcp --dport 80 -j ACCEPT -A INPUTETH2 -p tcp -m tcp --dport 25 -j ACCEPT -A INPUTETH2 -p tcp -m tcp --dport 110 -j ACCEPT -A INPUTETH2 -p udp -m udp --dport 53 -j ACCEPT -A INPUTETH2 -j DROP -A INPUTETH3 -p tcp -m tcp --dport 80 -j ACCEPT -A INPUTETH3 -p udp -m udp --dport 53 -j ACCEPT -A INPUTETH3 -p tcp -m tcp --dport 4000 -j ACCEPT -A INPUTETH3 -p tcp -m tcp --dport 6112 -j ACCEPT -A INPUTETH3 -p tcp -m tcp --dport 6200 -j ACCEPT -A INPUTETH3 -p tcp -m tcp --dport 6113 -j ACCEPT -A INPUTETH3 -j DROP -A INPUTLAN -p tcp -m tcp --dport 25 -j ACCEPT -A INPUTLAN -p tcp -m tcp --dport 110 -j ACCEPT -A INPUTLAN -p tcp -m tcp --dport 3128 -j ACCEPT -A INPUTLAN -p ip -s 192.168.91.222 -j ACCEPT -A INPUTLAN -p ip -s 192.168.91.254 -j ACCEPT -A INPUTLAN -p ip -s 192.168.91.88 -j ACCEPT -A INPUTLAN -p ip -s 192.168.91.233 -j ACCEPT -A INPUTLAN -p ip -s 192.168.91.0/24 -d ! 192.168.92.0/24 -j ACCEPT -A INPUTLAN -j DROP COMMIT # Completed on Thu Aug 16 14:10:37 2007
