1:1 NAT, DMZ and Masq

["Tiziano Müller" <tiziano@ifi.unizh.ch>]

Hi guys

I apologize for my first message, it was crap.
sorry.

Now, I\'ve a little problem and no idea how to
solve it, I hope, someone could give me a hint.

Situation:

Internet -- Firewall 1 -- DMZ -- Firewall 2 -- LAN
                           |-- Webserver = WWW
                           |-- FTP
                           |-- DNS

now, for the Server in the DMZ, I wanted to use a 1:1
NAT, for the hole rest Masq. So did I the follow (for the WWW)
on the Linux-Router:

10.0.0.4 = DMZ IP WWW; x.x.x.165 = Official IP WWW

ifconfig eth1:1:0 add x.x.x.165
(as described in the NAT HowTo, necessary for the ARP-Packets)

iptables -t nat -A PREROUTING -d x.x.x.165 -j DNAT --to 10.0.0.4
iptables -t nat -A POSTROUTING -s 10.0.0.4 -j SNAT --to x.x.x.165
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

So far it works well from the inside. From outside I can only ping
the WWW and connect with SSH, but not connect via FTP or WWW (the
services are up and running).

Has someone an idea, why this happens? Or a better idea to do this?

Thanks very much in advance
Tiziano