From: "Taylor, Grant" <gtaylor@riverviewtech.net>
To: netfilter@lists.netfilter.org
Subject: Re: NAT/MASQ on eth0 - doubt
Date: Sun, 01 May 2005 16:48:07 -0500 [thread overview]
Message-ID: <42754E97.7020506@riverviewtech.net> (raw)
In-Reply-To: <900a46901009.901009900a46@vsnl.net>
> My server is on Mandriva 10.1
> eth0 is WAN with static IP connected to 512K DSL
> eth1 is LAN - 192.168.0.0/24 and 192.168.21.0/24
....
> # Generated by iptables-save v1.2.9 on Tue Apr 26 14:50:01 2005
> *nat
> :OUTPUT ACCEPT [0:0]
> :PREROUTING ACCEPT [0:0]
> :POSTROUTING ACCEPT [0:0]
> -A POSTROUTING -o eth0 -j MASQUERADE
>
>
> So should I just masq all out ?
>
> Is it possible to use my static IP or
> subnets details to rewrite the above
> masq rule while I am doing a NAT on eth0 ?
Normally, per "man iptables" documentation, you MASQUERADE traffic that is on some sort of dynamic IP connection and SNAT traffic that is on a static IP connection. The main difference is that MASQUERADE will clear the state of MASQUERADing / SNATing when the interface goes down where as SNAT will not do so. The idea behind this is that you will likely get a different IP when you reconnect with a dynamic connection and thus the state information is stale and invalid. Seeing as how you have a static IP on your INet connection I would change the MASQUERADE target to be SNAT.
Grant. . . .
prev parent reply other threads:[~2005-05-01 21:48 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-05-01 6:14 NAT/MASQ on eth0 - doubt varun_saa
2005-05-01 21:48 ` Taylor, Grant [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=42754E97.7020506@riverviewtech.net \
--to=gtaylor@riverviewtech.net \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.