RE: Local rule for Port Forward

["Brad Morgan" <B-Morgan@concentric.net>]

>  I'm doing port forwarding to a server that runs jabber and everything
>  works fine, I did notice that if I bring up a jabber client on the
>  firewall itself I do not get connected.  While this isn't really
>  needed... I don't totally understand why it doesn't work.  Being
>  inquisitive... well I just gots to know why!  Can anyone shed some
>  light?
> 
>  My rules for the jabber port forward are:
> 
>  iptables -A FORWARD
>           -i $ExIF -d $JabIP -p tcp --dport $JabPort
>           -j ACCEPT
>  iptables -A PREROUTING
>           -t nat -d $ExIP -p tcp --dport $JabPort
>           -j DNAT --to-destination $JabIP
>  iptables -A POSTROUTING
>           -t nat -d $JabIP -p tcp --dport $JabPort
>           -j SNAT --to-source $InIP

The reason why jabber doesn't work on the firewall is because the PREROUTING
rule sends the packet to jabber server as requested.  It never reaches the
INPUT chain or the client running on the firewall.

An excellent reference for how packets traverse the iptables chains can be
found at http://iptables-tutorial.frozentux.net by Oskar Andreasson.  He
just posted a new version.

Regards,

Brad Morgan