Mike, You may also need to put an entry on the output in the NAT table as well. Here is what I have had to do in the past, to make things work. Please note that many people noted that this isn't necessary, and recommend using split DNS instead. But for some of the small officers I have setup, split DNS really wasn't an option. Here is a sample. -A PREROUTING -d 216.x.x.x -j DNAT --to-destination 10.94.17.2 -A POSTROUTING -s 10.94.17.2 -o eth0 -j SNAT --to-source 216.x.x.x # We had to add this to it so people on the local subnet would be able # to see the servers as if they are external. -A POSTROUTING -s 10.94.17.0/255.255.255.0 -d 10.94.17.2 -o eth0 -j SNAT --to-source 216.x.x.x -A POSTROUTING -o eth0 -p ! ipv6-crypt -j SNAT --to-source 216.x.x.x Now, in your case, the 192.168 if on a different 172.24 range, so it should have worked for you to begin with but you might need to do something like we've done above. HTH, Gary > -----Original Message----- > From: netfilter-bounces@xxxxxxxxxxxxxxxxxxx [mailto:netfilter- > bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Mike > Sent: Tuesday, August 21, 2007 5:05 AM > To: netfilter@xxxxxxxxxxxxxxxxxxx > Subject: Firewall Issues > > Hi all, > I have an issue with my linux iptables firewall and cannot figure out > what > to do. > I will make this as short and sweet as I can. > My Network is setup as follows: > Static IP: 24.106.xxx.xx > Firewall IP ETH1:(Static points to this) 172.24.xxx.xx > All my servers are ETH0: 192.168.0.xx > I have 2 game servers, 1 mail server and a web server. > My problem is I cannot see my websites, or join game servers unless I > put > this firewall rule in: iptables -A PREROUTING -d 24.xxx.xxx.xx -i eth0 > -j > DNAT --to-destination 192.xxx.x.35 (192.xxx.x.35 being my web server IP > Address) > With this rule I can from the inside of my network go to my website via > www.xxx.com but cannot join any of my game servers unless I chnage the > above > rule to the game server IP. > > Can anyone help me on this? > > Thanks in advance, > Mike >
