From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Gonzalo Parra" Subject: How to invert more than one destination network? Date: Mon, 1 Mar 2004 11:58:33 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <009901c3ffa6$0cdd0050$c800a8c0@cyclelogic.com> Reply-To: Mime-Version: 1.0 Content-Type: multipart/related; boundary="----=_NextPart_000_009A_01C3FF84.85CB6050" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_009A_01C3FF84.85CB6050 Content-Type: multipart/alternative; boundary="----=_NextPart_001_009B_01C3FF84.85CCE6F0" ------=_NextPart_001_009B_01C3FF84.85CCE6F0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi =20 I have MASQUERADE in a box as a gateway using IPTABLES and I am using = that box also for VPN... so for it to work I cant masquerade thaffic that = goes to the other side of the VPN... =20 This works for me: =20 IPTABLES -t nat -A POSTROUTING -o $EXTIF -d \! 192.168.20.0/26 -j = MASQUERADE =20 but now I have another network at the other side of the VPN (192.168.40.0/26), so how can I invert two networks in the -d??? =20 Thanks, =20 Gonzalo Parra =20 Network Administrator Tel: +58 (212) 265-5330 Cel: +58 (414) 240-4054 Caracas, VE ..................................... =20 =20 ------=_NextPart_001_009B_01C3FF84.85CCE6F0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Message
Hi
 
I have = MASQUERADE in=20 a box as a gateway using IPTABLES and I am using that box also for = VPN...=20 so for it to work I cant masquerade thaffic that goes to the other side = of the=20 VPN...
 
This = works for=20 me:
 
IPTABLES -t nat -A=20 POSTROUTING -o $EXTIF -d \! 192.168.20.0/26 -j = MASQUERADE
 
but = now I have=20 another network at the other side of the VPN (192.168.40.0/26), so = how can=20 I invert two networks in the -d???
 
Thanks,
 
Gonzalo Parra  =
Network Administrator
Tel: +58 (212) = 265-5330
Cel: = +58 (414) 240-4054
Caracas, VE
.....................................  
3D""
=
 
------=_NextPart_001_009B_01C3FF84.85CCE6F0-- ------=_NextPart_000_009A_01C3FF84.85CB6050 Content-Type: image/bmp; name="signature.bmp" Content-Transfer-Encoding: base64 Content-ID: <718405215@01032004-10D0> Qk3GHgAAAAAAADYEAAAoAAAAYQAAAEQAAAABAAgAAAAAAJAaAAAAAAAAAAAAAAABAAAAAQAAAAAA AP///wAAZv8Ars7+AAxs/gAadP4AHHX+ACV7/gAsf/4ALYD+ADGC/gA1hf4APIn+AEyS/gBdnf4A YJ7+AG2m/gB9sP4Ajbn+AJ3D/gC+1/4AzuH+AN7q/gDu9P4A0OH+AO/v7wDf398Az8/PAMLCwgC/ v78Ar6+vAJ+fnwCampoAj4+PAH9/fwBycnIAb29vAF9fXwBPT08APz8/AC8vLwAfHx8ADw8PAP// /wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMFOAAADwAAAQAAAAAAAAATBTgAl18AABh3+AAAAAAA AAAAAPlUAAAkABIAAAAAAPgpwAAAAHcASAATAAATDQAAACQAdUgAACwAEwAAEvkAAAIAAProAACn ABIAd/udAPgqCAD//3cA+P//AAAS+gD8sb4ADUh3AAAAEwAAAAAAAAAAAHOoAAAAAEgAAAAAABL5 oAAAAAAAMwAAAHf4KQATAAAAO/AAAAAAFwAAAAAAEvl8AAaIAAAwABMAABL6APudpwApUHcA/3f4 AP///wAS+kAAtt4AANh3/AAAEwcAFzv4ADwMAAD4ABcAABc7AAAAAQAAAQAA8AAAAAAXOwATAWgA AAAAAAcCCAAAAAAAWgBYAL4AAAAKABUAd/g6APzxkAA573cAAHf4AAATXgATXeAAPAwAAAAAFwAA AAAAAAAAAPo4AACnABIAd/udAPg6sAD//3cASP//AAAS+gATAAAAAAcAAAAAAAAAFzwAFzv4AAAB AAABAAAAABNdAPzwEAD5sHcAgAASAAAS+gAS+oAAnacAAJB3+wB3+CYA////APqQ/wArABIAd+jF ABMAAAAAAAAAAQAAAAAAAADhXTAAAAB3AAEAAAAAAAAA/eAAADngfwAAABcAAAAAABc7+AAAAAAA FAAAAAAAAQAS+lQAAAAAALAAAAAAEv8A6GFbAMVIdwD/d+gA////APgmkABN3HcA+ABDAAAXOwAT AAAAAAAAAAEAAAAAAAAAlYwAACc5uQAAAcIAwM1tAAAAJACMAAAAObmVAAHCJwAAAAAABmQAAAcA AAAAAAAAAAAAAG9sAABIb2cAABN1AAABIAC5GQAAeABAAAAdAQAdAXgA+zQAAKcAEgB3+50A+CaA AP//dwBE//8AABL7AOhl1gAAAHcACAATAAAUAAAAARgAXTAAAAB34QAAAAAAAAAAAAAAAAAAAAAA AAAAAETAxAB1cQAABAATAAAVwAATdXUAc9UAAP8ASAD///8AE3VIAMEuAABxAEQAABN1AAEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAABAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQAAAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAEoHiIiGyooJwEp JyoeIiIiIh8qACQBAQEaJikAHxsqKCgBABooJykdIQAfAAEkKSoeIh0BAB8AACUBAQEAAAABAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAaACQiIiQkASkdABoeJyIiIiIoHh8lAQEB JSIBJSokJAEpHQAdKhkqHSInAQAZABkfJyIdAQAiHx8qAQEBAAAAAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEAHyYpIiInIgEnHQABHQAiIiIiACIiIgEBARoZGSgqJyIBJx0AHScB Jx0iIgEAHQABHSciHQEAGSIqGwEBAQAAAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBACYfKCYiJSIBKB0AIR0mIiIiIikmJSoBAQEBIiopHSUiASgdAB0nAScdIiIBABoAAR4nIiId KiIoHRsBAQEAAAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAAGSEqIh4qJSoB ACkoHyIiIiIiAColAQEBGwAlAQEdKiUqGQAdJwEnICkpGwABJyYoIiIoKSYfKiklAQEBAAAAAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAKAEbACIBGx0aAQAZGwEdHSIiARsdAQEB ASEpHSglARsdGgEAGRsBGxolJRkiARkdHQEaGR0BARsdAQEBAQAAAAEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBACEBASkiAQEBAQEAAQEBIiIiIgEBAQEBAQEZKAAqGwEBAQEBAAEB AQEBGx0BAAEBAQEBAQEBAQEBAQEBAQEAAAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAAAAAQEBAQEBAQEBAQEBAQEBGygAJxsBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQMMAgICAggQFwEBAQEBAQEBAQEBAQEBAQEBAQAAAAEB AQEBAQEBAQEBAQEBAR0AAAAqGQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBARECAgICAgICAgQWAQEBAQEBAQEBAQEBAQEBAQEAAAABAQEBAQEBAQEBAQEBAQEa IiQAACIBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEGAgQD AQEXEgICDgEBAQEBAQEBAQEBAQEBAQEBAAAAAQEBAQEBAQEBAQEBAQEBAQEBJAApAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgIIAQEBAQEIAgwBAQEBAQEB AQEBAQEBAQEBAQAAAAEBAQEBARkhJycnJR0BAQEBARsAABsBAQEBGSInJyciGQEBAAAnAQEBIScn JyQaAQEWERERERERERETAQESDAwMDhYBARACAgMBFRQSAgIMFAICEQEBFxEMDAwRFwEBAQEAAAAB AQEBARsqAAAAAAAAHwEBAQEbAAAhAQEBGSgAAAAAACgZAQAAJwEBKAAAAAAAKhsBFAICAgICAgIC DAEMAgICAgIEFQEBDAICAgICAgICERQCAhEBFwgCAgICAggXAQEBAAAAAQEBARkpAAAqJygAAAAd AQEBIgAAKAEBASIAACoiJwAAIgEAACcBIgAAKB4iAAAnARQCAgICAgICAgwSAgIIAw0CAgYBFAIC AgICAgICEAEUAgIRARECAgQRCAICEQEBAQAAAAEBAQEhAAAqGwEBIQAAJgEBASgAAAAZAQEpAAAb ARkqACkBAAAnASkAKhkBASQAABoUAgIMAQEBAQEBCAICFgEBDAICFRECAhADFBQVAQEBFAICEQEG AgIVARcEAgYBAQEAAAABAQEBKAAAIQEBAQEqAAABARoAAAAAHwEZAAAoAQEBJwAAAQAAJxsAACUB AQEaIh8ZFAICDAEBAQEBAQICBgEBARECAhETAgITAQEBAQEBARQCAhEXAgIIAQEBDAICAQEBAAAA AQEBGQAAABoBAQEBJgAAHQEfAAAnACYBHQAAJwEBAQEBAQEAACcdAAAiAQEBAQEBARQCAgwBAQEB ARQCAgwBAQEDAgIRARACBAICBA4XAQEUAgIRFAICDAEBAQEBAQEBAQAAAAEBAR0AAAABAQEBARoa AQEBJgAqHgAAAR0AACcBAQEBAQEBAAAnHQAAKScnJycnJx8UAgIMAQEBAQEUAgIMAQEBFAICEAET AgIECAICCBcBFAICERQCAgwBAQEBAQEBAQEAAAABAQEdAAAnAQEBAQEBAQEBASoAJhkAAB4dAAAn AQEBAQEBAQAAJx0AAAAAAAAAAAAeFAICDAEBAQEBFAICDAEBARQCAhEXBAIEFwENAgISARQCAhEU AgIMAQEBAQEBAQEBAAAAAQEBHQAAJwEBAQEBAQEBAR0AACEBKAAlGwAAJwEBASQlIgEAACcbAAAl AQEBIgAAHRQCAgwBAQEBARYCAggBAQESAgIRFAICDQEBFAICDQEUAgIRFQICDAEBARAOEQEBAQAA AAEBAR0AACcBAQEBAQEBAQEkAAAbASQAKgEqAAAZAQEoACoBAAAnASoAKQEBASUAABkUAgIMAQEB AQEBBAICFwEBDgICAxQCAg0BARQCAhABFAICEQEEAgIXAQEIAgQBAQEAAAABAQEdAAApAQEBAQEB AQEBKQApAQEdAAAbJQAAJRkhAAAmAQAAJwEiAAAhAR0qACcBFAICDAEBAQEBAQ4CAg4BFAICBBcX AgIGFwERAgIWARQCAhEBDgICDhcSAgINAQEBAAAAAQEBGwAAAAEBAQEBHyUiHAAAJQEBAQAAJBoq AAAAAAAAGwEAACcBGSkAAAAAAAAdARQCAgwBAQEBAQEWBAICAgICAhIBARACAgYIAgIIAQEUAgIR ARYEAgICAgICFQEBAQAAAAEBAQEqAAAbAQEBAScAACMAAB8BAQEnACcBGycAAAApHgEBAAAnAQEa JwAAACkdAQEUAgIMAQEBAQEBARUMAgICBBIBAQEBEQQCAgIGAgMVFAICEQEBFQwCAgIGAwEBAQEA AAABAQEBJgAAJQEBARkAACoBAQEBAQEBAQEBAQEBGh0aAQEBAQAAJwEBAQEZHRsBAQEBFAICDAEB AQEBAQEBARcUFQEBAQEBAQEBFRQXEgICDAEVAwEBAQEBFhQWAQEBAQEBAAAAAQEBAR0AAAAhGRoo AAAlAQEBAQEBAQEBAQEBAQEBAQEBAQEAACcBAQEBAQEBAQEBARQCAgwBAQEBAQEBAQEBAQEBAQEB AQEBAQEBARcNAg4VBAITAQEBAQEBAQEBAQEBAQAAAAEBAQEBJQAAAAAAAAAqGgEBAQEBAQEBAQEB AQEBAQEBAQEBAAAnAQEBAQEBAQEBAQEUAgIMAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBFQQC EwEBAQEBAQEBAQEBAQEAAAABAQEBAQEkAAAAAAApGwEBAQEBARUUFBQUAQEBAQEBAQEBAQAAJwEB AQEBAQEBAQEBFAICDAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEVEwEBAQEBAQEBAQEBAQEB AAAAAQEBAQEBARofIiIeAQEBAQETDQQCAgICAgIOFgEBAQEBAQEdHRsBAQEBAQEBAQEBARcUFBUB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAAAAEBAQEBAQEBAQEB AQEBFxEEAgICAgICAgICAgITAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAABAQEBAQEBAQEBAQEBAwYCAgICAgICAgIC AgICAhMBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAAAAAQEBAQEBAQEBAQEXDgICAgICAgICAgICAgICAgICFgEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQAAAAEBAQEBAQEBAQEXCAICAgICAgICAgICAgICAgICAg0BAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAABAQEBAQEBAQEV BAICAgICAgICAgICDRIUFBQQBAICFwEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAQEBAQEBAQEWBAICAgICAgICAgQRFgEB AQEBARcIAhMBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQAAAAEBAQEBAQEXCAICAgICAgICAg0XAQEBAQEBAQEBFgQQAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEAAAABAQEBAQEBDQICAgICAgICBAMBAQEBAQEBAQEBAQEODAEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAQEBAQEBAwIC AgICAgICBhUBAQEBAQEBAQEBAQEBAwwBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAAAAEBAQEBFwQCAgICAgICCBcBAQEBAQEB AQEBAQEBARUMAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEAAAABAQEBARECAgICAgICBhcBAQEBAQEBAQEBAQEBAQEXDAEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAAAAAQEBARcEAgICAgICBBUBAQEBAQEBAQEBAQEBAQEBFBABAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAAAAEBAQETAgIC AgICAhMBAQEBAQEBAQEBAQEBAQEBAQMSAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAABAQEBDAICAgICAg0BAQEBAQEBAQEB AQEBAQEBAQEQFQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAAAAAQEBAQICAgICAgIWAQEBAQEBAQEBAQEBAQEBAQEBChEMDAwO FgEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQAAAAEBARQCAgICAgIOAQEBAQEBAQEBAQEBAQEBAQETCQsUFAMEAgQWAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAABAQETAgIC AgICFgEBAQEBAQEBAQEBAQEBARUNEwwWAQEBAwICEQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAQEBEQICAgICCAEBAQEBAQEBAQEB AQEBARMOFxQQAQEBARQCAhEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQAAAAEBARECAgICAhEBAQEBAQEBAQEBAQEBARMRARcIFwEBAQER AgIRAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEAAAABAQEUAgICAgIDAQEBAQEBAQEBAQEBARMSAQEOAwEBAQEBBgICAwEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAQEBFgIC AgICFAEBAQEBAQEBAQEBARUOAQESEQEBAQEBEwICBAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAAAAEBAQEIAgICAhMBAQEBAQEBAQEB ARcMFwERDgEBAQEBFwQCAhEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEAAAABAQEBAwICAgIOAQEBAQEBAQEBAQERFBcOEAEBAQEBAQ0C AgQXAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAAAAAQEBAQEOAgICAhUBAQEBAQEBAQEXDRQIAwEBAQEBARECAgISAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAAAAEBAQEB AQ4CAgIEFAEBAQEBAQEBDwcOFwEBAQEBARMCAgINAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAABAQEBAQEBAwYCAgIMEhQUFBIO BgUYAQEBAQEBARICAgIIFwEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAQEBAQEBAQEBFREMDAwMDA0RFAECAQEBAQEBFw4CAgII FwEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQAAAAEBAQEBAQEBAQEBAQEBAQEBAQEXAhcBAQEBFAYCAgIIFwEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAABAQEB AQEBAQEBAQEBAQEBAQEBFgIOFxcTDAICAgIMFwEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAQEBAQEBAQEBAQEBAQEBAQEB AQECAgICAgICAgIRAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAAAAEBAQEBAQEBAQEBAQEBAQEBAQEBDgICAgICAgwWAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEAAAABAQEBAQEBAQEBAQEBAQEBAQEBARcQBgIMEBYBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAAAAEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAAAA ------=_NextPart_000_009A_01C3FF84.85CB6050-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Gonzalo Parra" Subject: RE: How to invert more than one destination network? Date: Mon, 1 Mar 2004 12:17:42 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <00a101c3ffa8$b9e07730$c800a8c0@cyclelogic.com> References: <1078157259.1626.20.camel@pepelui.baicom> Reply-To: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <1078157259.1626.20.camel@pepelui.baicom> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1" To: 'Alexis' Cc: 'Netfilter' Is it that simple? I had the thought that that would make IPTABLES to masquerade = everithing... I mean: first rule will say MASQUERADE everything but 192.168.20.0/26 = and the seccond one will say MASQUERADE everything but 192.168.40.0/26 so = every IP (even those inside those networks) will always find a rule to go MAQUERADED... -----Original Message----- From: Alexis [mailto:alexis@attla.net.ar]=20 Sent: Lunes, 01 de Marzo de 2004 12:08 p.m. To: gparra@cyclelogic.com Cc: Netfilter Subject: Re: How to invert more than one destination network? add a new line with the second network :) On Mon, 2004-03-01 at 12:58, Gonzalo Parra wrote: > Hi > =20 > I have MASQUERADE in a box as a gateway using IPTABLES and I am using=20 > that box also for VPN... so for it to work I cant masquerade thaffic=20 > that goes to the other side of the VPN... > =20 > This works for me: > =20 > IPTABLES -t nat -A POSTROUTING -o $EXTIF -d \! 192.168.20.0/26 -j=20 > MASQUERADE > =20 > but now I have another network at the other side of the VPN=20 > (192.168.40.0/26), so how can I invert two networks in the -d??? > =20 > Thanks, > =20 > Gonzalo Parra > Network Administrator > Tel: +58 (212) 265-5330 > Cel: +58 (414) 240-4054 > Caracas, VE > ..................................... =20 >=20 > =20 --=20 Tus problemas no se pueden resolver en el mismo nivel mental que ten=EDas cuando los creaste.=20 Albert Einstein From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: How to invert more than one destination network? Date: Mon, 1 Mar 2004 16:18:37 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200403011618.37636.Antony@Soft-Solutions.co.uk> References: <009901c3ffa6$0cdd0050$c800a8c0@cyclelogic.com> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <009901c3ffa6$0cdd0050$c800a8c0@cyclelogic.com> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Monday 01 March 2004 3:58 pm, Gonzalo Parra wrote: > Hi > > I have MASQUERADE in a box as a gateway using IPTABLES and I am using that > box also for VPN... so for it to work I cant masquerade thaffic that goes > to the other side of the VPN... > > This works for me: > > IPTABLES -t nat -A POSTROUTING -o $EXTIF -d \! 192.168.20.0/26 -j > MASQUERADE > > but now I have another network at the other side of the VPN > (192.168.40.0/26), so how can I invert two networks in the -d??? Depending on how your VPN is set up, are you sure that packets to the other end of it are going out through $EXTIF anyway? I run VPNs using FreeS/WAN, and all the VPN traffic goes out through interface ipsec0, which I do not masquerade. Anyway, assuming that you do need to do what you asked, try matching the packets you don't want to masquerade, first, then masquerading anything that's left: iptables -A POSTROUTING -t nat -o $EXTIF -d 192.168.20.0/26 -j ACCEPT iptables -A POSTROUTING -t nat -o $EXTIF -d 192.168.40.0/26 -j ACCEPT iptables -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE Regards, Antony. -- You can spend the whole of your life trying to be popular, but at the end of the day the size of the crowd at your funeral will be largely dictated by the weather. - Frank Skinner Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: How to invert more than one destination network? Date: Mon, 1 Mar 2004 16:25:49 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200403011625.49547.Antony@Soft-Solutions.co.uk> References: <00a101c3ffa8$b9e07730$c800a8c0@cyclelogic.com> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <00a101c3ffa8$b9e07730$c800a8c0@cyclelogic.com> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: 'Netfilter' On Monday 01 March 2004 4:17 pm, Gonzalo Parra wrote: > Is it that simple? > > I had the thought that that would make IPTABLES to masquerade everithing... You are correct. See my previous posting for a suggestion on how to do it. Antony. > I mean: first rule will say MASQUERADE everything but 192.168.20.0/26 and > the seccond one will say MASQUERADE everything but 192.168.40.0/26 so every > IP (even those inside those networks) will always find a rule to go > MAQUERADED... > > -----Original Message----- > From: Alexis [mailto:alexis@attla.net.ar] > Sent: Lunes, 01 de Marzo de 2004 12:08 p.m. > To: gparra@cyclelogic.com > Cc: Netfilter > Subject: Re: How to invert more than one destination network? > > > add a new line with the second network :) > > On Mon, 2004-03-01 at 12:58, Gonzalo Parra wrote: > > Hi > > > > I have MASQUERADE in a box as a gateway using IPTABLES and I am using > > that box also for VPN... so for it to work I cant masquerade thaffic > > that goes to the other side of the VPN... > > > > This works for me: > > > > IPTABLES -t nat -A POSTROUTING -o $EXTIF -d \! 192.168.20.0/26 -j > > MASQUERADE > > > > but now I have another network at the other side of the VPN > > (192.168.40.0/26), so how can I invert two networks in the -d??? > > > > Thanks, > > > > Gonzalo Parra > > Network Administrator > > Tel: +58 (212) 265-5330 > > Cel: +58 (414) 240-4054 > > Caracas, VE > > ..................................... -- A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing? A: Top-posting. Q: What is the most annoying thing on usenet and in e-mail? Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexis Subject: Re: How to invert more than one destination network? Date: Mon, 01 Mar 2004 13:07:39 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1078157259.1626.20.camel@pepelui.baicom> References: <009901c3ffa6$0cdd0050$c800a8c0@cyclelogic.com> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <009901c3ffa6$0cdd0050$c800a8c0@cyclelogic.com> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="macroman" To: gparra@cyclelogic.com Cc: Netfilter add a new line with the second network :) On Mon, 2004-03-01 at 12:58, Gonzalo Parra wrote: > Hi > =20 > I have MASQUERADE in a box as a gateway using IPTABLES and I am using > that box also for VPN... so for it to work I cant masquerade thaffic > that goes to the other side of the VPN... > =20 > This works for me: > =20 > IPTABLES -t nat -A POSTROUTING -o $EXTIF -d \! 192.168.20.0/26 -j > MASQUERADE > =20 > but now I have another network at the other side of the VPN > (192.168.40.0/26), so how can I invert two networks in the -d??? > =20 > Thanks, > =20 > Gonzalo Parra =20 > Network Administrator > Tel: +58 (212) 265-5330 > Cel: +58 (414) 240-4054 > Caracas, VE > ..................................... =20 >=20 > =20 --=20 Tus problemas no se pueden resolver en el mismo nivel mental que ten=C3=ADas cuando los creaste.=20 Albert Einstein