Re: Non host resident proxies

[Magnus Sundberg <Magnus.Sundberg@dican.se>]

Hi,
Thanks for your answer.
It will not work, since NAT rewrites the destination header, which is 
used by the pop3vscan proxy to find out the actual host.

But I found out later
iptaples -t mangling -p tcp --dport 110 -s ! <ip_host> -j ROUTE --gw 
<ip_host>

According to Cédric, the author of the ROUTE target, you need to use CVS 
for p-o-m and source, since there are some compatibility issues between 
the new patch-o-matic-20030107 with the old iptables-1.2.7a.

/Magnus

Rob Sterenborg wrote:
>>I want to redirect all POP3 requests back to my main server. POP3 
>>requests from the main server is forwarded to the internet. 
>>Something like this.
>>
>>------------          -------------------
>>!          !          !                 !
>>! Client   !--------->! router/firewall !
>>!          !      ----!                 !
>>------------      ! ->! - - - - - - - - ! ---->(Internet)
>>                   ! ! !                 !
>>                   ! ! -------------------
>>-------------     ! !
>>!           !<----- !
>>! Server    !--------
>>!           !
>>-------------
>>
>>I can scan all pop3 traffic for viruses by this method.
>>I believe this setup would be correct for proxying other 
>>protocols to. I would preferably be interested in also being 
>>able to redirect the 
>>protocol port too.
>>Is it possible to do this with the current netfilter release?
>>I am aware that there is good chance of unwanted loops with this setup
> 
> 
> You mean to just DNAT port 110/tcp (pop3) to <ip_server> ?
> 
> I assume :
> eth0 : inet
> eth1 : lan
> eth2 : dmz
> 
> iptables -i eth0 [-o eth2] -d <ip_server> -p tcp --dport 110 -j ACCEPT
> itables -t nat -A PREROUTING -i eth0 -p tcp --dport 110 --to-destination
> <ip_server>
> 
> 
> Rob
> 
>