Re: DNAT/MASQ Precedence

[Athan <netfilter@miggy.org>]

[-- Attachment #1: Type: text/plain, Size: 1339 bytes --]

On Fri, Jan 31, 2003 at 01:41:11PM +0000, Katriel Traum wrote:
> On Friday 31 January 2003 11:19, Athan wrote:
> >   Basically not allowing ICMP in a blind fashion is NOT the way to do
> > things.  You probably just need to make sure you have the proper FORWARD
> > rules (filter chain, it's the default so no -t) to allow both
> > ESTABLISHED and RELATED.  You can find these in any mention of SNAT in
> > docs/howtos.
> Ofcourse ICMP is important. I wan't going to leave it out.
> The qiestion is will the rule:
> iptables -A PREROUTING -i $INET_IF -p icmp --dport ! 60000:62000 -j DNAT \
> - --to-destination $DMZ_IP
> 
> do it? and what about ICMP messages aimed back at the LAN?
> This will all be acompanied with the apropriate -m state entries.

   This I'm mostly sure won't work.  As I kind of said above, what you
want is -m state --state RELATED rules to do it, as RELATED includes
'icmp to do with this connection'.  No need for ports or IPs as it'll
get info on which connections to do it for and where to pass it from the
connection tracking.

-Ath
-- 
- Athanasius = Athanasius(at)miggy.org / http://www.miggy.org/
                  Finger athan(at)fysh.org for PGP key
	   "And it's me who is my enemy. Me who beats me up.
Me who makes the monsters. Me who strips my confidence." Paula Cole - ME

[-- Attachment #2: Type: application/pgp-signature, Size: 240 bytes --]