Re: DNAT/MASQ Precedence

[Athan <netfilter@miggy.org>]

[-- Attachment #1: Type: text/plain, Size: 1554 bytes --]

On Fri, Jan 31, 2003 at 01:14:06PM +0000, Katriel Traum wrote:
> Okay, sounds good, so say I want to save me a 2000 SNAT ports (I don't think 
> I'll have 2000 sockets open at the same time)
> here's the ruleset I should use:
> 
> iptables -A PREROUTING -i $INET_IF -p tcp --dport ! 60000:62000 -j DNAT \
> - --to-destination $DMZ_IP
> iptables -A PREROUTING -i $INET_IF -p udp --dport ! 60000:62000 -j DNAT \
> - --to-destination $DMZ_IP
> 
> iptables -A POSTROUTING -o $INET_IF -i $LAN_IF -j SNAT --to-source \
>  $INET_IP:60000-62000

   Looks good at first glance here.

> as for ICMP, I didn't quite understand you. can you elaborate?

  For TCP to operate correctly you *NEED* some ICMP working.  ICMP isn't
just for ping!  There are things like network, host and port
unreachable.  There's also things like Path MTU discovery which involves
an ICMP message being sent back if a packet is too big for part of the
route and has the Do not Fragment (DF) flag set.
  Basically not allowing ICMP in a blind fashion is NOT the way to do
things.  You probably just need to make sure you have the proper FORWARD
rules (filter chain, it's the default so no -t) to allow both
ESTABLISHED and RELATED.  You can find these in any mention of SNAT in
docs/howtos.

HTH,

-Ath
-- 
- Athanasius = Athanasius(at)miggy.org / http://www.miggy.org/
                  Finger athan(at)fysh.org for PGP key
	   "And it's me who is my enemy. Me who beats me up.
Me who makes the monsters. Me who strips my confidence." Paula Cole - ME

[-- Attachment #2: Type: application/pgp-signature, Size: 240 bytes --]