On Wed, 2009-07-15 at 16:12 -0400, Mike Williams wrote: > Simon, > > Hi there. Would you mind posting the output of iptables-save? After > reading about your battle with this it would be nice to see the > complete set of working rules. Also, having the final solution in the > archives may help someone else. > > Thanks, > > Mike Hi Mike! Well, our set of iptables rules is rather large. It performs several tasks like blocking access to some ports on the server, blocking access to some hosts, performing NAT for other hosts, etc. To be useful for the community, this set of rules would require a detailed explanation which I am not prepared to give because our company's policies do not allow me to do so. But the solution to my problem were the couple of rules proposed by Thomas Jacob: > On Mon, 2009-07-13 at 16:14 +0200, Thomas Jacob wrote: > > You need DNAT+SNAT for this: > > > > # Redirect to IP:Port > > iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 10025 \ > > -j DNAT --to-destination 172.20.1.254:25 > > > > # Ensure that the replies come back to us > > iptables -t nat -A POSTROUTING -o eth0 -p tcp --dport 25 \ > > -d 172.20.1.254 -j SNAT --to-source 172.20.1.245 These rules did the job, but there was another one that I didn't notice at first. This rule was blocking traffic to port 25: # iptables -A FORWARD -p tcp -s 172.20.1.245 -d 0/0 --dport 25 -j DROP As soon as I removed this rule everything went fine. Regards, Simion. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
