From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pascal Hambourg Subject: Re: Iptables proxy to a different network Date: Fri, 09 Feb 2007 12:27:13 +0100 Message-ID: <45CC5A91.4090200@plouf.fr.eu.org> References: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="iso-8859-1"; format="flowed" To: netfilter@lists.netfilter.org Hello, Andrus, Mr. Brian (Contractor) a =E9crit : > I have a system with a single nic and ip address a.b.c.1 (system A) > I want to proxy incoming requests to port 80 to a different system on a > different subnet of x.y.z.1 (system B) >=20 > On system a.b.c.1, I am trying the following in my > /etc/sysconfig/iptables: > ----------- > *nat > -A PREROUTING -p tcp --dport 80 -j DNAT --to x.y.z:80 > COMMIT > ----------- >=20 > This seems to ALMOST work. The request from a client system (System C) > go to System A, get rewritten and are received by system B. System B > seems to be responding, trying to send to System C directly, but (I > think) System C is expecting its response to be from system A, not > System B, so it ignores the responses. As usual. Known issue. If you cannot or do not wish to prevent direct routing between the=20 client and the server, you must SNAT the forwarded connections in the=20 POSTROUTING chain.