Simion Onea wrote:
On Tue, 2009-07-14 at 11:25 +0200, Mart Frauenlob wrote:
Remember for the POSTROUTING rule, the previously redirected packets
come from the host:port, NOT go to the host again.
You need `-s xxx.xxx.xxx.xxx --sport xx' -j SNAT ....
Hi Mart!
But this rule is for the packets leaving host 172.20.1.245 not for the
packets coming back from 172.20.1.254.
The first rule changes packets' destination address and port (DNAT) so
that they go to the other host. And the second rule changes packets'
source address (SNAT) so that the other host returns the packets back to
this host (172.20.1.245) not to the originating host from the LAN
(172.20.1.xxx).
When the packets return back from 172.20.1.254 to 172.20.1.245 the
kernel it is supposed to recognize that these packets were previously
DNAT-ed and SNAT-ed and to reverse back their source and destination
addresses and send them back to the originating host from the LAN
(172.20.1.xxx).
This is the way I understand the process.
Regards,
Simion.
oops, sorry my bad :/
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
