iptables? issue

[jdow]

This is what I did some time ago. I've not tried it with the latest iptables.
(I spun my own firewall.) REDIR is the local IP to be redirected to. And
REDIRPORT is the port to be redirected. EXTIF and INTIF are probably
obvious. (If they aren't you may need some reading time.)

/sbin/iptables -A FORWARD -p tcp -i $EXTIF -o $INTIF -d $REDIR --dport 
$REDIRPORT -j ACCEPT

/sbin/iptables -t nat -A PREROUTING -p tcp -i $EXTIF -d $EXTIP --dport 
$REDIRPORT -j DNAT --to $REDIR
/sbin/iptables -t nat -A PREROUTING -p udp -i $EXTIF -d $EXTIP --dport 
$REDIRPORT -j DNAT --to $REDIR

{^_^}


On 2012/02/17 05:15, nullv at gmx.com wrote:
>
>
>>
>> I was reading this thread and when I hit nullv's message the coin dropped
>> about routers if he wants to use one of his Internet addresses as a
>> gateway for the internal network. If he wants access to his 10.x.y.z
>> network, though, that db0 machine will have to come in through one of
>> his computers using port forwarding, not necessarily NAT. And if he wants
>> db0 to be exposed on the Internet he'd have to play the aliasing tricks.
>> It's not clear to me just what he was trying to do. Using one of his
>> machines as a router/gateway/firewall makes a lot of sense from a security
>> standpoint. For the 10.x.y.z he'd want to use NAT, though. That would hide
>> the db0 machine from the Internet quite nicely while other machines showed
>> cleanly.
>>
>> {^_^}
>> --
>
> I've been trying out the SNAT-ing the ips through one-to-one rules such as:
>
> -A POSTROUTING -i eth0 -o eth1 -s 10.0.0.2/32 -j SNAT --to-source 41.123.234.56/32
>
> but i doesn't seem to work as expected. If i MASQUERADE the wan ip evertything
> seems to work but for SNAT i can't seem to get a direct from inside my lan to
> the outside.
> I'm missing something again?
>