Re: Mail Server Behind IPTABLES

[Alistair Tonner <Alistair@nerdnet.ca>]

	CC;ed the list for consistency.

	See inline below

On September 1, 2004 12:02 pm, Matevz wrote:
> Na 1094050244, 2004-09-01 ob 16:50, je Alistair Tonner napisal(a):
> > On August 31, 2004 09:01 pm, Ajen Diwakar wrote:
> > > Hi All
> > >
> > > I am new to IPTABLES usage. I have linux(RH) 9.0.
> > > The external IP address eth1 is 202.62.x.x
> > > The internal ip address is 10.0.0.4
> > >
> > > My mail server IP address is 10.0.0.10
> > >
> > > How do I setup my iptables so that the mail to my record get transfred
> > > to the mail server.
> > >
> > > Any assistance will be appreciated.
> >
> > 	iptables -t nat -A PREROUTING -p TCP -i {internet device} -d 202.62.x.x 
> > \ --dport 25 -j DNAT -to 10.0.0.10
> >
> > 	iptables -A FORWARD -p TCP -i {internet device} -d 10.0.0.10 --dport 25 
> > \ -j ACCEPT
> >
> > 	(assuming FORWARD -P DROP )
> >
> >
> > 	Alistair Tonner
>
> Hi,
>
> I using this for a while and i have a problem.
> For connctions from outside works just fine, but if i want to access
> from my LAN dont work.

	Because your LAN clients attempt to connect to [publlc IP of mailserver], get 
connected by reroute through firewall.  Mailserver see's connection from 
[LANIP] of client and replies *direct* to [LANIP] client.  Client knows NOT 
of LANIP of mailserver and does not consider the connection valid.

	iptables -I PREROUTING -p TCP -i [LAN device] -d [PUBLIC IP mailserver]  \ 
--dport 25 -j DNAT -to 10.0.0.10
	iptables -A FORWARD -p TCP -i [LAN device] -d 10.0.0.10 -s [LAN SEGMENT]   \ 
--dport 25  -j ACCEPT
	iptables -I POSTROUTING -p TCP -i [LAN device] -d 10.0.0.10 -s [LAN SEGMENT]\
 --dport 25 -j SNAT -to 10.0.0.4

	This makes the connection at the mailserver think your firewall is 
connecting.  Weird, but NOW the replies from the mailserver go back through 
the firewall, and the client will accept the connection as valid.

	A slightly better way to do this is split DNS that tells the clients on the 
LAN to use the LAN ip of the mailserver.  -- a different topic.

	Possibly you want to do the same for port 110 from inside the LAN/??


>
> I have also tried without -i.
>
> And i was tried this with adding one new rule so it was like -i [eth
> witch is conncted to LAN]
>
> In all cases sharing of internet connction stops working.

	iptables -P FORWARD DROP
	
	iptables -A FORWARD -s [LAN_SEGMENT] -i [LAN_DEVICE] -d 0.0.0.0 -j ACCEPT
	iptables -A FORWARD -d [LAN_SEGMENT] -m state --state RELATED,ESTABLISHED  \
-j ACCEPT

	
	iptables -A POSTROUTING  -o [INTERNET_DEVICE] -j MASQUERADE 
	or
	iptables -A POSTROUTING -o [INTERNET_DEVICE] -j SNAT -to [internet address]


	keep in mind that you might want to review the ORDER in which the rules 
load .... it can be critical as to what gets processed when

iptables -Lnvx 
iptables -Lnvx -t nat
iptables -Lnvx -t mangle.



	Alistair Tonner