On Tue, 2009-07-14 at 11:25 +0200, Mart Frauenlob wrote: > Remember for the POSTROUTING rule, the previously redirected packets > come from the host:port, NOT go to the host again. > You need `-s xxx.xxx.xxx.xxx --sport xx' -j SNAT .... Hi Mart! But this rule is for the packets leaving host 172.20.1.245 not for the packets coming back from 172.20.1.254. The first rule changes packets' destination address and port (DNAT) so that they go to the other host. And the second rule changes packets' source address (SNAT) so that the other host returns the packets back to this host (172.20.1.245) not to the originating host from the LAN (172.20.1.xxx). When the packets return back from 172.20.1.254 to 172.20.1.245 the kernel it is supposed to recognize that these packets were previously DNAT-ed and SNAT-ed and to reverse back their source and destination addresses and send them back to the originating host from the LAN (172.20.1.xxx). This is the way I understand the process. Regards, Simion. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
