Re: how to change ip source address of incoming packets

["Gáspár Lajos" <swifty@freemail.hu>]

Matevz Langus írta:
> To easy to be true. Tried this one already. I get this:
>
> iptables v1.3.5: Can't use -i with POSTROUTING
>
:-D Right :-D
Okay, then try this:

iptables -t mangle -A PREROUTING -j CONNMARK -i eth0.10 -s 192.168.1.1 
-d $firewal_virtual_ip_on_10 --set-mark 1
iptables -t mangle -A PREROUTING -j CONNMARK -i eth0.11 -s 192.168.1.1 
-d $firewal_virtual_ip_on_11 --set-mark 2
...
iptables -t nat -A PREROUTING -j DNAT -m connmark --mark 1 
--to-destination $firewal_real_ip_on_10
iptables -t nat -A PREROUTING -j DNAT -m connmark --mark 2 
--to-destination $firewal_real_ip_on_11
...


iptables -t mangle -A OUTPUT -j CONNMARK -d 192.168.10.1 --set-mark 1
iptables -t mangle -A OUTPUT -j CONNMARK -d 192.168.11.1 --set-mark 2
...

iptables -t nat -A OUTPUT -j DNAT -m mark ! --mark 0 --to-destination 
192.168.1.1

iptables -t mangle -A POSTROUTING -j ROUTE -m mark --mark 1 --oif  eth0.10
iptables -t mangle -A POSTROUTING -j ROUTE -m mark --mark 2 --oif  eth0.11
...
iptables -t nat -A POSTROUTING -j SNAT -m mark --mark 1 --to-source 
$firewal_virtual_ip_on_10
iptables -t nat -A POSTROUTING -j SNAT -m mark --mark 2 --to-source 
$firewal_virtual_ip_on_12
...

With this scenario the devices on the VLANs can only talk to the firewall...

> Matevz
>
> On Nov 15, 2006, at 9:13 AM, Gáspár Lajos wrote:
>
>> iptables -t nat -A POSTROUTING -j SNAT -i eth0.10 -s 192.168.1.1 
>> --to-source 192.168.10.1
>
>