RE: possibly annoing ...

["Matt Hellman" <mhellman@taxandfinance.com>]

I'll give you an example. It assumes a default drop policy. Also, INTIF =
internal interface, HTTP1 = external ip address clients will connect to
(www.mydomain.com resolves to this address), and HTTPDMZ1 = internal web
server.

##### Setup prerouting rules to route Internet traffic internally
## Change the destination of external $HTTP requests to the DMZ HTTP server
$ipt -t nat -A PREROUTING -i $EXTIF -p tcp -d $HTTP1 --dport 33333 -j DNAT
--to $HTTPDMZ1:80

## Allow established,related forward traffic
$ipt -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

## Allow new http forward traffic from Internet to servers in the DMZ
$ipt -A FORWARD -m state --state NEW -i $EXTIF -p tcp -d $HTTPDMZ1 --dport
80 -j ACCEPT
$ipt -A FORWARD -m state --state NEW -i $EXTIF -p tcp -d $SMTPDMZ --dport 25
-j ACCEPT

>>-----Original Message-----
>>From: netfilter-admin@lists.netfilter.org 
>>[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of PiSiC...
>>Sent: Thursday, February 27, 2003 12:15 PM
>>To: richardo@start-global.com
>>Cc: netfilter@lists.netfilter.org
>>Subject: Re: possibly annoing ...
>>
>>
>> First of all thanks for help ...
>> but i'm kinda new with iptables and i want to show you the 
>>big picture :
>>
>> - i heard something about static NAT and dynamic NAT (not source or
>>destination NAT) and i'm not sure i fully understand what is the
>>aplicability on my situation.
>>
>>the situation is this :
>>
>> i have a radio link with only one staticaly allocated  IP 
>>(aaa.bbb.ccc.ddd)
>>which is connected on my linux machine on eth1
>>eth0 on the same machine is connected on LAN.
>>I have up and running Webserver,SMTP,FTP and POP3.
>>I want to run now 2 webservers one on external and one on 
>>internal(that is
>>easy with binding on their interfaces).
>>But i want also to allow access from the world to a third 
>>webserver which
>>runs on 192.168.13.199:80 which will be accesibile on port 33333 on my
>>external ip.
>>
>>... my machine runs Slackware 8.0 with kernel 2.4.5. and i 
>>have compiled the
>>kernel with all the features included(i don't need modprobe).
>>
>>
>>I wonder if you can give me an rc.firewall for this situation 
>>or at least
>>the tricky part(webserver on 192.168.13.199) with all their 
>>related stuff.
>>
>>       Thank you very much in advance.
>>
>>                                                      Danila Octavian
>>
>>
>>
>>