NAT Box

[Simone Sestini <simone.sestini@eutelia.it>]

Hi all..

I'm developing a nat box for some special Internet Value Added Services.
I have a lot of NAS boxes that receives calls and then the default 
router for all is the nat box.
The box has 2 ethernet interfaces, one public for internet acces and one 
over my intranet lan.
I have just done a lot of special configuration but right now i'm in 
front of a problem..
Normaly a /23 subnet is always natted with a public ip address.
Now.. i need to resolve a problem..

A special /23 need to browse only on some specific destination.. but if 
one client with the ip into the /23 try to
browse out of the range of the ip permitted i need to redirect the 
request automatically to 1 or more specific
ip address.


This is the example that is working correct without the automatically 
redirection.
The 10.30.14.0 /23 can browse some public ip addresses but if it try to 
go out of the range the REJECT rules
block the packet and the final client will not browse..

/usr/local/sbin/iptables -t nat -A POSTROUTING -s 10.30.14.0/23 -o eth0 
-j SNAT --to PUBLIC_IP_FOR_NAT

/usr/local/sbin/iptables -N PERSONAL_RULES
/usr/local/sbin/iptables -A PERSONAL_RULES -j ACCEPT -s 10.30.14.0/23 -d 
First_Public_IP
/usr/local/sbin/iptables -A PERSONAL_RULES -j ACCEPT -s 10.30.14.0/23 -d 
Second_Public_IP
/usr/local/sbin/iptables -A PERSONAL_RULES -j ACCEPT -s 10.30.14.0/23 -d 
Third_Public_IP
/usr/local/sbin/iptables -A PERSONAL_RULES -j ACCEPT -s 10.30.14.0/23 -d 
Other_Public_IP
/usr/local/sbin/iptables -A PERSONAL_RULES -j ACCEPT -s 10.30.14.0/23 -d 
Other_Public_IP
/usr/local/sbin/iptables -A PERSONAL_RULES -j REJECT -s 10.30.14.0/23 -d 0/0

/usr/local/sbin/iptables -A FORWARD -s 10.30.14.0/23 -p tcp --dport 80 
-j PERSONAL_RULES

Now i have to do something that permit me to add a new feature..
I have to remove the REJECT rules and have to find the way to redirect 
the request to a specific ip.. maybe with a DNAT ??

Any idea ? all is appreciated..

Best Regards.