Dear List!
I have the following setup:
eth0 (WAN, with multiple alias IPs), eth1 (LAN1), eth2 (LAN2), eth3 (LAN3)
I would like to setup DNAT, in order to achieve the following:
packets coming from eth0 to a certain IP and tcp port get NATed to an IP
and port for a machine on one of the LAN subnets
I have read the relevant HOWTO and made the following setup:
# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use
Iface
aaa.bbb.ccc.ddd 0.0.0.0 255.255.255.248 U 0 0
0 eth0
192.168.5.0 0.0.0.0 255.255.255.0 U 0 0 0 eth3
192.168.4.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
0.0.0.0 aaa.bbb.ccc.eee 0.0.0.0 UG 0 0
0 eth0
# cat /var/lib/iptables/testing
# Generated by iptables-save v1.3.5 on Fri Dec 22 14:23:36 2006
*mangle
:PREROUTING ACCEPT [1804:164934]
:INPUT ACCEPT [1576:145710]
:FORWARD ACCEPT [208:12864]
:OUTPUT ACCEPT [988:111965]
:POSTROUTING ACCEPT [1239:130436]
COMMIT
# Completed on Fri Dec 22 14:23:36 2006
# Generated by iptables-save v1.3.5 on Fri Dec 22 14:23:36 2006
*nat
:PREROUTING ACCEPT [58:10171]
:POSTROUTING ACCEPT [13:1459]
:OUTPUT ACCEPT [13:1459]
-A PREROUTING -d aaa.bbb.ccc.fff -i eth0 -p tcp -m tcp --dport 25 -j
DNAT --to-destination 192.168.3.1
-A PREROUTING -j LOG --log-prefix "PREROUTING: " --log-level 7
COMMIT
# Completed on Fri Dec 22 14:23:36 2006
# Generated by iptables-save v1.3.5 on Fri Dec 22 14:23:36 2006
*filter
:INPUT ACCEPT [1576:145710]
:FORWARD ACCEPT [208:12864]
:OUTPUT ACCEPT [988:111965]
-A FORWARD -d 192.168.3.1 -i eth0 -o eth1 -p tcp -m tcp --dport 25 -j
ACCEPT
-A FORWARD -j LOG --log-prefix "FORWARD: " --log-level 7
COMMIT
# Completed on Fri Dec 22 14:23:36 2006
If I telnet 192.168.3.1 25 on the firewall, an SMTP session starts. If I
telnet from outside (coming on eth0), it waits until timeout. I just
can't figure out why it is not working. At last I removed all the IP
aliases, and it didn't work that way either. There is nothing relevant
in /var/log/syslog. I have 1 in /proc/sys/net/ipv4/ip_forward.
Please help. Thanks in advance.
Yours sincerely,
Fülöp Balázs
|