Zhen Zhou a écrit :
On 12/16/06, Pascal Hambourg <pascal.mail@plouf.fr.eu.org> wrote:
Insert this kind of rule before the generic SNAT rule :
$ipt -t nat -A POSTROUTING -o <interface> -s 192.168.2.208 -p <proto> \
[--dport <port>] -j SNAT --to 210.153.22.y
Thanks for your help, but the issue is still there, so I post what I
add iptables rules in the system then we could analyze where is the
issue:
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state NEW -d 192.168.3.208 -p tcp
--dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -d 210.153.22.y -p tcp --dport 80 -j
DNAT --to 192.168.3.208
So far so good.
iptables -t nat -A POSTROUTING -o 210.153.22.y -s 192.168.3.208 -p tcp
--sport 80 -j SNAT --to 210.153.22.y
The -o (output interface) option takes a network interface name, not an
IP address. Also, why do you match on source port 80 ? NAT rules can
match only packets in the NEW state opening a new connection, but TCP
packets with source port 80 are usually return packets (thus in
ESTABLISHED state) from a web server.
I assign:
ip addr add 210.153.22.y dev eth1 label eth1:1
in the another hand, I want to track the network link when I access
web to some sites, nothing show me via:
netstat -ant | grep 192.168.3.208
nothing .....
netstat shows only the state of local sockets, not forwarded
connections. To see the the state of all tracked connections (incoming,
outgoing and forwarded), use :
cat /proc/net/ip_conntrack
|