Re: DNAT-Problem

[Jason Opperisano <opie@817west.com>]

On Thu, 2004-09-09 at 06:29, Tom Fischer wrote:
> This is the only rule.
> 
> [root@server4 root]# iptables -t nat -vnL
> Chain PREROUTING (policy ACCEPT 645K packets, 35M bytes)
>  pkts bytes target     prot opt in     out     source              
> destination             2   120 DNAT       tcp  --  *      *      
> 0.0.0.0/0            oldmachine       tcp dpt:9000 to:newmachine
> 
> Chain POSTROUTING (policy ACCEPT 62473 packets, 3966K bytes)
>  pkts bytes target     prot opt in     out     source              
> destination         
> 
> Chain OUTPUT (policy ACCEPT 62441 packets, 3964K bytes)
>  pkts bytes target     prot opt in     out     source              
> destination         
> 
> >         
> > another thought--NAT happens first (PREROUTING), then filter rules. 
> > you will need to edit your filter rule to allow traffic to
> > "newserver's" actual IP instead of "oldserver's" actual IP.
> > 
> 
> There are no Filterrules installed at the moment.
> 
> Tom

what are the IP addresses of $oldmachine and $newmachine (obfuscate the
first two octets if you must)?

are you trying to DNAT from one machine on the local network to another
machine on the local network?  what network is the client traffic
sourcing from?  is it the same network?

-j

-- 
Jason Opperisano <opie@817west.com>