On 06/16/08 14:41, Artem Y. Pervin wrote:
I want to do a simple thing. I want some port of the external interface to redirect TCP traffic to the private network.
Ok...
So, I have the following rule sequence:
At a quick glance your rules seem to be ok.
When I try to access my machine from a remote host, everything works fine:
*nod*
I've tried to use the external ip adress as well, but I'm getting the same result:
*nod*
What is wrong with my configuration? Why iptables ignore the rule for the localhost case?
I don't think it is anything with your rules per say. Rather I think the problem is that you are trying to redirect something from localhost to something not on localhost. The Linux kernel will prevent this for security reasons.
I would suggest that you use some sort of proxy program (see below) listening on localhost:30099 that will proxy connections to 192.168.10.119:22 for you.
You could even have the proxy program listen on the external interface, or all interfaces for that matter, and do all the redirecting for you. However keep in mind that when the proxy program connects to 192.168.10.119 on your behalf, the connection(s) will appear to be from the host running the proxy app, so logging on the target host will not show the real source of the connection. If you think about it, when the host that is doing the redirecting connects to 192.168.10.119, it would be the source of the traffic, so there is little difference (if any) in it connecting via the proxy or connecting directly to 192.168.10.119.
With this in mind, I would be tempted to DNAT with IPTables so that the target host will see the real source IP and proxy traffic from localhost on the DNAT box to 192.168.10.119.
"socat" and "rinetd" are a couple of example proxy applications. Grant. . . . -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
