Re: is it possible to nat to the routed IP?

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Zhen Zhou a écrit :
> On 12/16/06, Pascal Hambourg <pascal.mail@plouf.fr.eu.org> wrote:
>>
>> Insert this kind of rule before the generic SNAT rule :
>>
>> $ipt -t nat -A POSTROUTING -o <interface> -s 192.168.2.208 -p <proto> \
>>    [--dport <port>] -j SNAT --to 210.153.22.y
> 
> Thanks for your help, but the issue is still there, so I post what I
> add iptables rules in the system then we could analyze where is the
> issue:
> 
> iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
> iptables -A FORWARD -m state --state NEW -d 192.168.3.208 -p tcp
> --dport 80 -j ACCEPT
> iptables -t nat -A PREROUTING -d 210.153.22.y -p tcp --dport 80 -j
> DNAT --to 192.168.3.208

So far so good.

> iptables -t nat -A POSTROUTING -o 210.153.22.y -s 192.168.3.208 -p tcp
> --sport 80 -j SNAT --to 210.153.22.y

The -o (output interface) option takes a network interface name, not an 
IP address. Also, why do you match on source port 80 ? NAT rules can 
match only packets in the NEW state opening a new connection, but TCP 
packets with source port 80 are usually return packets (thus in 
ESTABLISHED state) from a web server.

> I assign:
> ip addr add 210.153.22.y dev eth1 label eth1:1
> 
> in the another hand, I want to track the network link when I access
> web to some sites, nothing show me via:
> netstat -ant | grep 192.168.3.208
> nothing .....

netstat shows only the state of local sockets, not forwarded 
connections. To see the the state of all tracked connections (incoming, 
outgoing and forwarded), use :

cat /proc/net/ip_conntrack