Re: "DNAT" w/o changing source address?

[Grant Taylor <gtaylor@riverviewtech.net>]

On 10/04/07 08:14, John Madden wrote:
> Hmm, well here are the rules I'm running.  The port forward:
> 
> echo "1" > /proc/sys/net/ipv4/ip_forward

*nod*

> iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 25 -j DNAT 
> --to $MAILSERVER:25

*nod*

> And the SNAT for return traffic:
> 
> iptables -t nat -A POSTROUTING -d $MAILSERVER -j SNAT --to $EXTIP

Um, here in lies the rub.

> ...At least, I found that traffic wouldn't flow without this 
> additional rule.  Have I gotten something else fundamentally wrong 
> here?

That is very odd.  Do you have other rules in place that could be 
interfering with what you are doing?

Normally with a server behind a NAT all I need to do is DNAT the traffic 
and allow the returning traffic to pass back out through the same NATing 
system and allow it's outbound MASQUERADEing / SNAT to hide the internal 
source IP address.

If you do not have this type of scenario but rather both the redirecting 
IP and the real mail server's IP are both globally routable, then you 
may need to do something else.  Is this possibly the case?



Grant. . . .