Re: Internal NAT Translation:

[ro0ot <ro0ot@phreaker.net>]

Here is my example below: -

###############################################################################
#
# Destination NAT on the same network
#
###############################################################################
 
$IPTABLES -A FORWARD -i eth1 -o eth1 -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -d 192.168.2.254 -s 192.168.2.0/24 -p 
tcp --dport 22 -j SNAT --to 192.168.2.1
$IPTABLES  -t nat -I PREROUTING -d 200.200.200.200 -p tcp --dport 22 -j 
DNAT --to 192.168.2.254
 
Regards,
ro0ot


Bryan Martin wrote:

>Setup looks like this
>
>            Internet
>                 ^
>Redhat 9 iptables nat/masq    (200.200.200.200 public address = eth1;
>192.168.2.1 private address = eth0)
>                 ^
>windows web server (192.168.2.254) | windows clients.    (all 192.168.2.X)
>
>
>Now the rh box is masquerading for the private boxes.  Only thing not
>standard is that any inbound http connections to the public address
>200.200.200.200 is being dnatted to 192.168.2.254 which is the address of
>the windows server.  This is working as expected.  The problem arises when a
>internal client tries to connect to the public website.
>
>For instance client request www.mycompany.com and DNS says go here
>200.200.200.200 which would be correct if I was sitting on the outside
>looking in.  I need iptables to basically say if any http request comes from
>the internal network addressed to my public address dnat the public
>200.200.200.200 to the private address.  I have tried the following without
>success.  Only other thing I know is to setup a internal DNS just so the
>internal clients get the internal address.  That would however be an extreme
>waste of resources.
>
>-A PREROUTING -i eth1 -d 200.200.200.200 -p tcp --dport 80 -j
>DNAT --to-destination 192.168.2.254
>
>Can someone help?
>
>Bryan
>
>
>
>  
>