[no subject]

On Thu, Aug 05, 2004 at 02:47:02PM -0400, Christopher Woodfield wrote:
> Hello,
> 
> I tried to set up static NAT rules on my iptables firewall, and was not 
> able to get it to work. A possible cause of the problem (which I 
> haven't been able to test yet) is that I have a series of port-specific 
> rules for each host in addition to the SNAT and DNAT rules.
> 
> Here are my SNAT/DNAT rules. $HOSTNAME variables are public IPs and 
> $HOSTNAME_NAT are private IPs; $INETIF is the outside interface and 
> $LANIF is the inside:
> 
> # Set up Static SNAT entries (private to public)
> $IPTABLES -t nat -A POSTROUTING -o $INETIF -s $TINO_NAT -j SNAT 
> --to-source $TINO
> $IPTABLES -t nat -A POSTROUTING -o $INETIF -s $ELECTRO_NAT -j SNAT 
> --to-source $ELECTRO
> $IPTABLES -t nat -A POSTROUTING -o $INETIF -s $TWEEK_NAT -j SNAT 
> --to-source $TWEEK
> 
> # Set up Static DNAT entries (public to private)
> $IPTABLES -t nat -A PREROUTING -i $INETIF -d $TINO -j DNAT 
> --to-destination $TINO_NAT
> $IPTABLES -t nat -A PREROUTING -i $INETIF -d $ELECTRO -j DNAT 
> --to-destination $ELECTRO_NAT
> $IPTABLES -t nat -A PREROUTING -i $INETIF -d $TWEEK -j DNAT 
> --to-destination $TWEEK_NAT
> #
> 
> Then I have a series of port rules, an example is below:
> 
> # ssh
> $IPTABLES -A FORWARD -p tcp -i $INETIF -o $LANIF -d $TINO_NAT --dport 
> 22 -j ACCEPT
> 
> Are rules like these evaluated before or after the DNAT transformation 
> is done? That is, should the -d on these rules be $TINO_NAT or $TINO?
> 
> Thanks,
> 
> -C

-- 
James Sumners
<a  rel="nofollow" href="http://ug.dyndns.org/~jsumners/";>http://ug.dyndns.org/~jsumners/</a>

&quot;All governments suffer a recurring problem: Power attracts pathological personalities. It is not that power corrupts but that it is magnetic to the corruptible. Such people have a tendency to become drunk on violence, a condition to which they are quickly addicted.&quot;

Missionaria Protectiva, Text QIV (decto)
CH:D 59
-------------- next part --------------
A non-text attachment was scrubbed...
Name: iptables.sh
Type: application/x-sh
Size: 1731 bytes
Desc: not available



</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00152" href="msg00152.html">[ale] iptables problems...static NAT and filtering rules...</a></strong>
<ul><li><em>From:</em> rekoil at semihuman.com (Christopher Woodfield)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00152.html">[ale] iptables problems...static NAT and filtering rules...</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00154.html">[ale] Distro for Mom?</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00152.html">[ale] iptables problems...static NAT and filtering rules...</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00176.html">[ale] iptables problems...static NAT and filtering rules...</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00153"><strong>Date</strong></a></li>
<li><a href="threads.html#00153"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>