Re: Forward internal packets as though they're external

[Jon Heese <netfilter@jonheese.com>]

Okay, so I assume you're saying I should try:

iptables -vt nat -A POSTROUTING -p tcp --dport 6969 -s 192.168.0.0/24 \
     -d 192.168.0.100 -j SNAT --to 65.9.134.4

Tried that and got no errors running the firewall/nat script, but still 
no go connecting to 65.9.134.4:6969 from 192.168.0.101.

I thought about the scenario, and I think I see why it's not working:

A SYN packet from Webster addressed to 65.9.134.4:6969 goes to the 
router, and the router sends it to Castor because of its DNAT chain. 
Castor gets this packet with a source address of Webster 
(192.168.0.101), and sends back an ACK directly to Webster across the 
local segment, so the packet never has to even cross the router, and 
therefore the SNAT rule I added above is never met.  Webster sees the 
ACK from Castor and throws it away, since it never knowingly tried to 
connect to Castor.

So, it seems there is no simple way to do what I want to do here with 
iptables.  I suppose I'll have to figure out a clever DNS scheme to take 
care of this.

If anyone has any ideas, no matter how complicated, I'd certainly be 
interested in hearing them.

Regards,
Jon Heese

/dev/rob0 wrote:
> On Thursday 2005-October-27 09:38, I wrote:
> 
>>Perhaps you need a SNAT rule in POSTROUTING:
> 
> 
> That's probably correct.
> 
> 
>>iptables -vt nat -A PREROUTING -p tcp --dport 6969 -s 192.168.0.0/24
>>\ -d 192.168.0.100 -j SNAT --to 65.9.134.4
> 
> 
> The example, obviously, is not correct. Copy/paste/PEBKAC error.