From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ivan Gustin Subject: Re: Rerouting remote users to VPN channel Date: Tue, 25 Apr 2006 10:21:07 +0200 Message-ID: <444DDBF3.6050500@pu.t-com.hr> References: <444D25BA.6040505@pu.t-com.hr> Reply-To: ivan.gustin@pu.t-com.hr Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Matt Barclay Cc: netfilter@lists.netfilter.org Matt Barclay: > Yes, you need SNAT and DNAT rules. Something like this ought to work Thank you, Matt, for answering. > iptables -t mangle -A PREROUTING -d -p tcp --dport 80 > -j MARK --set-mark 80 > iptables -t nat -A PREROUTING -m mark --mark 80 -j DNAT --to 192.168.30.9 > iptables -A FORWARD -m mark --mark 80 -j ACCEPT > iptables -t nat -A POSTROUTING -m mark --mark 80 -j SNAT --to > Yes, I set up something like this few hours ago, and it worked. But, unfortunately, Intranet Web application uses absolute private IP addresses, so that can't work. Application starts, but when user clicks on some option connection hangs trying to open http://192.168.30.9/.... :-( I can't change third-party Web app. I don't see any other solution but setting up VPN so users have private routeable IP addresses. Thanks anyway. GI