Re: Packet forwarding.

[bdameron@tscnet.net]

Quoting Antony Stone <Antony@Soft-Solutions.co.uk>:

> On Wednesday 07 April 2004 6:25 pm, bdameron@tscnet.net wrote:
> 
> > > If you tell us what your rules are and give us some more detail about
> > > your network setup, we might be able to help, however a better solution
> > > for you is to look at some of the excellent documentation available to
> > > learn how to do it yourself.   This is not a hard problem, and you will
> be
> > > able to manage your system much better in future if you understand more
> > > about how it works.
> > >
> > > One very important detail which is not clear from your description above
> > > is: where is the "client machine" located?
> >
> >   Client machine being anyone from the outside world. And I have looked
> > over some of the documentation. Basically there is no current firewall
> > policies. Just want anything coming in on xxx.xxx.xxx.xxx:443 (Internet
> > Machine) to be routed to 10.10.1.110:443 (Internal Lan Machine).
> >
> > Looks like I need to mangle the packet header so that the Lan machine
> thinks
> > that the Internet machine is sending the packet and then have the Internet
> > machine redirect the packet to the client. Client again being someone on
> the
> > Internet. Not sure if this can be done or not. Correct me if I am wrong.
> 
> With all due respect, yes, you are very wrong.   This is a simple "nat + 
> forward" situation.
> 
> Since you haven't said what your ruleset is, I shall assume none, and give
> you 
> an example of how to make work what you have asked for:
> 
> iptables -F
> iptables -F -t nat
> iptables -P INPUT DROP
> iptables -P OUTPUT DROP
> iptables -P FORWARD DROP
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 443 -d 10.10.1.110 -j ACCEPT
> iptables -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 10.10.1.110
> 
> If eth0 is not your external interface then change it in the above two rules
> 
> for whatever your external interface is.
> 
> Regards,
> 
> Antony.
> 

I found an easier way to do this. xinetd can do port redirect. Worked perfectly.
Thanks for your help.

-- 
Thank you,
Brad Dameron