From mboxrd@z Thu Jan 1 00:00:00 1970 From: Igor Tsinman Subject: Re: NAT FROM public ip TO public ip Date: Sat, 08 Jan 2005 10:43:58 +0200 Message-ID: <41DF9D4E.3040809@go-wlan.com> References: <10459.1105072608@www72.gmx.net> <41DCE77F.4020503@go-wlan.com> <1105102641.5112.0.camel@linux.site> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1105102641.5112.0.camel@linux.site> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Mario Ohnewald Cc: netfilter@lists.netfilter.org Mario Ohnewald wrote: >On Thu, 2005-01-06 at 08:23, Igor Tsinman wrote: > > >>Mario Ohnewald wrote: >> >> > > > >>>This is a real easy question, but i will explain it in detail so that you >>>know what i am on about ;) >>> >>>I have two internet boxes, both have only one nic. >>>Box A is my root box. >>>Box B is a ftp server (where i am not admin, but i have an ftp account). >>> >>>Both, Box A and B have a public ip address. >>>You can NOT access the ftp server from the outside. >>>ONLY Box A can connect to that ftp server (Box B). >>> >>>So i though i could simply nat a connection through my Box A, to Box B. >>>If i connect from the real bad world, to my Box A, port 2121. Box A could >>>forward/NAT that to the internal ftp box. >>> >>>I have tried it with this rule: >>>$IPT -t nat -A PREROUTING -i eth0 -p tcp -d 123.123.123.123 -m helper >>>--helper ftp-2121 -j DNAT --to-destination 123.123.123.111 >>> >>>and >>> >>>modprobe ip_conntrack_ftp ports=21,2121 >>> >>> >>>But it looks like its not working. >>>I did a tcpdump -i eth0 -n host 123.123.123.111 >>> >>> >>>And no packages where transfered to the ftp box (123.123.123.111). >>>Any idea why? Am i going the right way at all? >>> >>>Thanks, Mario >>> >>> >>> >>> >>> >>You have to add an additional rule: >>$IPT -A FORWARD -p tcp -i eth1 -d 23.123.123.123 --dport 2121 -j ACCEPT >> >>For this example, eth0 is external and eth1 is internal. >> >> > >I only have one network card. > > > >Cheers, Mario > > > > > See "DNAT forwarding on same interface": http://lists.netfilter.org/pipermail/netfilter/2002-July/036620.html Cheers, Igor Tsinman