Destination Nat Loopback Clarified !

Destination Nat Loopback Clarified !

[Mark Ayad]

I though I'd try and clarify the problem.

----------------------
[A]
 IP    192.168.0.3
 MASK: 255.255.255.0
 GATE: 192.168.0.1

HTTP Server
192.168.0.3 :80
---------------------
        | 192.168.0.3 [mask 255.255.255.0]
        |
        |
        |
        | eth1 192.168.0.1 [mask 255.255.255.0]
----------------------
[B]
  MASQ Gateway
  Firewall
----------------------
  |eth0 A.B.D.C DHCP
  |
  |
  |
  Internet

#######################################################
#Working MASQ Gateway + Port Forwarding on 80 to 192.168.0.3

EXTIF="eth0"
INTIF="eth1"

$IPTABLES -A INPUT -p tcp --syn --destination-port 80 -j ACCEPT
$IPTABLES -A INPUT -p tcp --syn -j DROP

$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $INTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG


$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 --dport \
80 -j DNAT --to-destination 192.168.0.3:80

$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
#######################################################

What I can't do and I've tried all your suggestions which on the face of it
might actually be more complex than it first seems:

[A] both the HTTP server 192.168.0.3:80 and a Client that connects to the
gateway via eth1 192.168.0.1 [B] which is a MASQ gateway that routes
everything to the DHCP assigned IP A.B.D.C on eth0.

The DHCP public IP A.B.C.D can be reached via a Public name. So back to my
original problem [that ain't going away] Host [A] in a web browser whishes
to connect to itself but it uses the public IP address a.k.a A.B.D.C which
is prerouted to 192.168.0.3:80.

So Infact we have a glorfied LOOP-BACK-ADAPTER do we not ? Futile I know,
but the only other option to test that the HTTP server 192.168.0.3:80  on A
can be reached by some one on the internet using the DHCP assigned IP
A.B.D.C on eth0 is to use a anonymous web proxy to simulate a true ouside
request.

This has nearly go me licked, and so far there is no answer ?

Re: Destination Nat Loopback Clarified !

[Tom Eastep]

>
> This has nearly go me licked, and so far there is no answer ?
>

Well, I just set up the exact same scenario with Shorewall and it worked 
fine. Unfortunately, I don't have the time right now to dig through your 
rules and give you further advice.

I'll try to get to it this evening.

Back to my real job,
-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net