Linux Netfilter discussions
 help / color / mirror / Atom feed
From: "Mark Ayad" <mark@javamark.com>
To: netfilter@lists.samba.org
Subject: Destination Nat Loopback Clarified !
Date: Wed, 10 Jul 2002 18:29:06 +0200	[thread overview]
Message-ID: <00e201c2282e$e9e12bd0$0300a8c0@W2KP01> (raw)

I though I'd try and clarify the problem.

----------------------
[A]
 IP    192.168.0.3
 MASK: 255.255.255.0
 GATE: 192.168.0.1

HTTP Server
192.168.0.3 :80
---------------------
        | 192.168.0.3 [mask 255.255.255.0]
        |
        |
        |
        | eth1 192.168.0.1 [mask 255.255.255.0]
----------------------
[B]
  MASQ Gateway
  Firewall
----------------------
  |eth0 A.B.D.C DHCP
  |
  |
  |
  Internet

#######################################################
#Working MASQ Gateway + Port Forwarding on 80 to 192.168.0.3

EXTIF="eth0"
INTIF="eth1"

$IPTABLES -A INPUT -p tcp --syn --destination-port 80 -j ACCEPT
$IPTABLES -A INPUT -p tcp --syn -j DROP

$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $INTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG


$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport \
80 -j DNAT --to-destination 192.168.0.3:80

$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
#######################################################

What I can't do and I've tried all your suggestions which on the face of it
might actually be more complex than it first seems:

[A] both the HTTP server 192.168.0.3:80 and a Client that connects to the
gateway via eth1 192.168.0.1 [B] which is a MASQ gateway that routes
everything to the DHCP assigned IP A.B.D.C on eth0.

The DHCP public IP A.B.C.D can be reached via a Public name. So back to my
original problem [that ain't going away] Host [A] in a web browser whishes
to connect to itself but it uses the public IP address a.k.a A.B.D.C which
is prerouted to 192.168.0.3:80.

So Infact we have a glorfied LOOP-BACK-ADAPTER do we not ? Futile I know,
but the only other option to test that the HTTP server 192.168.0.3:80  on A
can be reached by some one on the internet using the DHCP assigned IP
A.B.D.C on eth0 is to use a anonymous web proxy to simulate a true ouside
request.

This has nearly go me licked, and so far there is no answer ?











             reply	other threads:[~2002-07-10 16:29 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2002-07-10 16:29 Mark Ayad [this message]
2002-07-10 16:59 ` Destination Nat Loopback Clarified ! Tom Eastep

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='00e201c2282e$e9e12bd0$0300a8c0@W2KP01' \
    --to=mark@javamark.com \
    --cc=netfilter@lists.samba.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox