Re: NATing on a single interface?

[Robert Nichols <rnicholsNOSPAM@comcast.net>]

Philip Pemberton wrote:
> It appears to be mangling the packets - e.g. an inbound packet from 
> 12.34.56.78 to 98.76.54.32 (PPP_IP) gets its destination IP changed to 
> the DMZ address (e.g. 10.0.0.1 for my server). Return packets are sent 
> to the source (e.g. 12.34.56.78 in the example) using the DSL router 
> (10.1.0.2) as the gateway.
>
> What I need to figure out is how to actually set up the firewall. I > 
> did find a nice IPTables tutorial, but it's 357 pages long! Guess I'd 
> better stop procrastinating and start reading....

If your other machines are set up to use the DSL router as the default
route, of course that's where the return packets will go.  You have
two choices:

1. (Preferable) Set up the default route on your other machines so
    that they use the firewall machine as their gateway to the outside
    world.

2. SNAT the forwarded packets so that they appear to come from the
    firewall machine.  This really screws up logging on your other
    machines (all traffic will appear to originate on the firewall
    machine), so you probably don't want to do it that way.

If that's Oskar Andreasson's tutorial you've got, you'll find you
really don't need to read through the whole thing.  The section on
the DNAT target is what you need right now.

-- 
Bob Nichols         Yes, "NOSPAM" is really part of my email address.