From: "Mark Ayad" <mark@javamark.com>
To: netfilter@lists.samba.org
Subject: Destination Nat Loopback Clarified !
Date: Wed, 10 Jul 2002 18:29:06 +0200 [thread overview]
Message-ID: <00e201c2282e$e9e12bd0$0300a8c0@W2KP01> (raw)
I though I'd try and clarify the problem.
----------------------
[A]
IP 192.168.0.3
MASK: 255.255.255.0
GATE: 192.168.0.1
HTTP Server
192.168.0.3 :80
---------------------
| 192.168.0.3 [mask 255.255.255.0]
|
|
|
| eth1 192.168.0.1 [mask 255.255.255.0]
----------------------
[B]
MASQ Gateway
Firewall
----------------------
|eth0 A.B.D.C DHCP
|
|
|
Internet
#######################################################
#Working MASQ Gateway + Port Forwarding on 80 to 192.168.0.3
EXTIF="eth0"
INTIF="eth1"
$IPTABLES -A INPUT -p tcp --syn --destination-port 80 -j ACCEPT
$IPTABLES -A INPUT -p tcp --syn -j DROP
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $INTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG
$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport \
80 -j DNAT --to-destination 192.168.0.3:80
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
#######################################################
What I can't do and I've tried all your suggestions which on the face of it
might actually be more complex than it first seems:
[A] both the HTTP server 192.168.0.3:80 and a Client that connects to the
gateway via eth1 192.168.0.1 [B] which is a MASQ gateway that routes
everything to the DHCP assigned IP A.B.D.C on eth0.
The DHCP public IP A.B.C.D can be reached via a Public name. So back to my
original problem [that ain't going away] Host [A] in a web browser whishes
to connect to itself but it uses the public IP address a.k.a A.B.D.C which
is prerouted to 192.168.0.3:80.
So Infact we have a glorfied LOOP-BACK-ADAPTER do we not ? Futile I know,
but the only other option to test that the HTTP server 192.168.0.3:80 on A
can be reached by some one on the internet using the DHCP assigned IP
A.B.D.C on eth0 is to use a anonymous web proxy to simulate a true ouside
request.
This has nearly go me licked, and so far there is no answer ?
next reply other threads:[~2002-07-10 16:29 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-07-10 16:29 Mark Ayad [this message]
2002-07-10 16:59 ` Destination Nat Loopback Clarified ! Tom Eastep
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='00e201c2282e$e9e12bd0$0300a8c0@W2KP01' \
--to=mark@javamark.com \
--cc=netfilter@lists.samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox