Re: [LARTC] Redirecting wayward traffic

[Adrian Chung <adrian@enfusion-group.com>]

On Tue, Jun 05, 2001 at 08:09:41AM -0500, David Talbot wrote:
> #THIS IS THE PROBLEM LINE
> iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 10.0.0.1
> #THIS IS THE PROBLEM LINE

I think I know what the problem is.

Before that though, Juri is right in saying that this is more easily
and effectively achieved using Squid, but, that being said...

You're trying to do DNAT onto the same network.  You change the
destination IP of the packets back onto the local network, but when
they hit 10.0.0.1 they look like they came from the external IP of
your router, and so they get dropped.

Look at:

http://netfilter.samba.org/unreliable-guides/NAT-HOWTO/NAT-HOWTO.linuxdoc-10.html

Try adding:

iptables -t nat -A POSTROUTING -p tcp -s <yourLAN> -d 10.0.0.1 --dport
80 -j SNAT --to <NATboxIP>

It worked for me, but I had to do some other fiddling because I'm also
doing policy based (source) routing, and so my setup might not quite
be the same as yours, but it's worth a try.

If you use tcpdump, you should see packets hitting 10.0.0.1 from a
non-LAN IP.

--
Adrian Chung (adrian at enfusion-group dot com)
http://www.enfusion-group.com/~adrian
GPG Fingerprint: C620 C8EA 86BA 79CC 384C E7BE A10C 353B 919D 1A17
[rogue.enfusion-group.com] up 28 days, 23:15, 3 users


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/2.4Routing/